LiteLLM Gateway Flaws Chain From MCP Auth Bypass (CVE-2026-59822, CISA KEV) to Root RCE and Cloud Credential Theft

CVE-2026-35029 is a broken access control flaw (CWE-863, CWE-425) in LiteLLM, an open-source proxy server (AI Gateway) for calling LLM APIs, in which the /config/update endpoint fails to enforce admin-role authorization in versions prior to 1.83.0. Any user who is already authenticated to the proxy can call this network-accessible endpoint without admin rights and modify the proxy configuration and environment variables. Through this, an attacker can achieve remote code execution by registering pass-through endpoint handlers that point to attacker-controlled Python code, read arbitrary server files by setting UI_LOGO_PATH and fetching the file via /get_image, and take over other privileged accounts by overwriting the UI_USERNAME and UI_PASSWORD environment variables; related security coverage also highlights that vulnerable LiteLLM gateways can be turned into root-level code execution and cloud credential theft. Any organization running a LiteLLM proxy older than v1.83.0 is affected, particularly deployments where non-admin users hold authenticated accounts. No public proof-of-concept or confirmed in-the-wild exploitation is known and the flaw is not in CISA KEV, but EPSS assigns a 25.1% probability of exploitation within 30 days (98th percentile), signaling elevated near-term risk.

Do: Upgrade to LiteLLM v1.83.0 or later. Until patched, restrict network access to /config/update so only administrators can reach it, and limit how many non-admin accounts hold API/UI credentials on the proxy. Audit configuration and environment variables for tampering (especially UI_USERNAME, UI_PASSWORD, UI_LOGO_PATH, and registered pass-through handlers), and rotate cloud credentials stored in the gateway's environment if compromise is suspected.

LiteLLM through 2026-04-08 allows remote attackers to execute arbitrary code via bytecode rewriting at the /guardrails/test_custom_code URI.

CVE-2026-42271 is a command injection (CWE-77/CWE-78) in BerriAI LiteLLM's proxy server, a widely used AI gateway for calling LLM APIs. Two MCP preview endpoints (POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list) accept a full stdio server configuration, including command, args, and env fields, and spawn the supplied command as a subprocess on the proxy host; the endpoints are gated only by any valid proxy API key with no role check, so even low-privilege internal-user keys can trigger it. An attacker with any authenticated key gains arbitrary command execution with the privileges of the proxy process, and reporting indicates attackers are chaining the flaw into broader takeover of AI gateway servers, including reverse shells and crypto miners, in some cases via weak or default keys such as the example 'sk-1234' admin key. Any organization running LiteLLM versions 1.74.2 through before 1.83.7, including LiteLLM distributed with Red Hat OpenShift AI, is affected. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2026-06-08 and is under active attack, with a very high EPSS of 83.6% for exploitation within 30 days.

Do: Upgrade LiteLLM to version 1.83.7 or later immediately (federal agencies must act per CISA KEV/BOD 22-01), and apply Red Hat's advisory updates if running OpenShift AI. Until patched, restrict or rotate proxy API keys — especially low-privilege internal-user and any default/example keys such as 'sk-1234' — and limit network access to the /mcp-rest/test/* endpoints. Review proxy hosts for indicators of compromise such as unexpected spawned subprocesses, reverse shells, or crypto miners, and rotate credentials that may have been captured via compromised environments.

Kludex Starlette prior to version 1.0.1 did not validate the HTTP Host request header before using it to reconstruct request.url, an inconsistency classified as HTTP request/response smuggling (CWE-444). Because routing operates on the raw ASGI scope path while request.url is rebuilt from the unvalidated Host header, an attacker can send a malformed Host header so that request.url.path differs from the path the router actually processed. Any middleware or endpoint that enforces security restrictions based on request.url rather than the raw scope path can then be tricked into approving requests that should have been blocked, bypassing those controls. All Starlette deployments below 1.0.1 are affected, both direct users and downstream products that bundle the library, including Red Hat offerings such as Ansible Automation Platform, OpenShift AI, OpenShift Lightspeed, Satellite, AI Inference Server, Migration Toolkit for Applications, and Enterprise Linux AI. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2026-09-02, confirming active exploitation; related reporting describes attackers deploying reverse shells and crypto miners, and EPSS ranks it in the 98th percentile with a 36.3% probability of exploitation within 30 days.

Do: Upgrade Starlette to 1.0.1 or later, which validates the Host header against RFC 9112/RFC 3986 grammar and falls back to scope['server'] for malformed values, and apply the corresponding Red Hat updates for each bundled product listed above. Until patched, review middleware and endpoints that enforce security decisions from request.url and validate or pin the Host header at your reverse proxy or load balancer. As a KEV entry, federal agencies must patch per BOD 26-04 timelines based on each asset's internet exposure, and operators of internet-facing AI infrastructure should verify their Starlette/FastAPI dependency versions.

LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.82.0-stable, LiteLLM's Custom Code Guardrails production create and update paths did not apply the same sandboxing and validation used by the test endpoint, allowing a privileged user with access to create or update guardrails to submit custom Python code that executed in the LiteLLM proxy environment and could expose secrets available to the process. This issue is fixed in version 1.82.0-stable.

BerriAI LiteLLM, a widely used self-hosted AI gateway and proxy server for calling LLM APIs, fails to properly authenticate requests to its MCP Streamable HTTP endpoint in versions prior to 1.84.0. An unauthenticated attacker can send a fabricated Authorization header that triggers an OAuth2 passthrough fallback, which replaces failed LiteLLM key validation with an empty UserAPIKeyAuth() object and lets the request reach MCP tooling without any valid LiteLLM key. Successful exploitation grants unauthenticated access to the gateway's MCP tooling with high confidentiality impact per the CVSS 4.0 score of 8.8, and public reporting describes attackers chaining LiteLLM weaknesses from authentication bypass to root code execution and cloud credential theft. Any organization running LiteLLM before 1.84.0 is affected, particularly gateways exposed to the internet. The flaw is confirmed exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2026-09-02, while EPSS currently estimates a 0.9% probability of exploitation in the next 30 days.

Do: Upgrade LiteLLM to version 1.84.0 or later immediately, in line with the CISA KEV required action and BOD 26-04 guidance for internet-exposed assets. Audit whether the MCP endpoint is reachable from the internet and check for signs of exploitation, including unexpected MCP tool calls, use of fabricated Authorization headers, and use of default or example admin keys such as 'sk-1234'. Until patched, restrict access to the MCP endpoint and review cloud credentials accessible from the gateway host for signs of theft or root-level activity.