Full Report
How default keys, unauthenticated MCP sessions, and custom code guardrails expose cloud AI infrastructure to root-level remote code execution and IAM theft.
Analysis Summary
# Vulnerability: LiteLLM Multi-Vector Compromise (Auth Bypass & RCE)
## CVE Details
* **CVE ID:** CVE-2026-59822 (MCP Auth Bypass), CVE-2026-59821 (Custom Code RCE)
* **CVSS Score:** Not explicitly listed in text, but categorized as "Root-level RCE" and "Cloud Compromise." CVE-2026-59822 is present in CISA KEV.
* **CWE:** CWE-287 (Improper Authentication), CWE-94 (Code Injection)
## Affected Systems
* **Products:** LiteLLM (Open-source AI Gateway)
* **Versions:** Versions prior to the patches released in September 2026.
* **Configurations:**
* Deployments using default master keys (e.g., `sk-1234`).
* Instances with no authentication configured (defaults to `PROXY_ADMIN` access).
* Instances with the Model Context Protocol (MCP) enabled.
* Instances utilizing custom code guardrails or pass-through endpoints.
## Vulnerability Description
Research identified three primary security flaws in the LiteLLM architecture:
1. **MCP Authentication Bypass (CVE-2026-59822):** A flaw in the `user_api_key_auth_mcp.py` handler allows an arbitrary Bearer token to create a valid session, bypassing intended security controls for the MCP endpoint.
2. **Custom Code RCE (CVE-2026-59821):** The `guardrail_endpoints.py` feature allows administrators to submit Python code. The server processes this via `exec(compile(...))`, allowing a user with admin privileges (often obtained via default keys or the auth bypass) to execute arbitrary code at the root level.
3. **Unauthenticated Admin Default:** When no auth is configured, LiteLLM grants all users `PROXY_ADMIN` privileges by default.
4. **Credential Theft via Pass-through:** The `pass_through_endpoints.py` feature lacks URL validation, allowing authenticated users to proxy requests to internal cloud metadata services (IMDS) to steal IAM roles/credentials.
## Exploitation
* **Status:** **Exploited in the Wild.** CVE-2026-59822 is included in CISA’s Known Exploited Vulnerabilities (KEV) catalog. PoC was presented at DEF CON 34.
* **Complexity:** Low (exploiting default keys and bypasses requires minimal technical effort).
* **Attack Vector:** Network (Internet-facing deployments).
## Impact
* **Confidentiality:** Total (Full access to LLM API keys, prompts, responses, and cloud environment credentials).
* **Integrity:** Total (Ability to modify guardrails and execute arbitrary code on the host).
* **Availability:** Total (Root-level access allows for complete system shutdown or resource exhaustion).
## Remediation
### Patches
* LiteLLM has released patches addressing CVE-2026-59822 and CVE-2026-59821. Users should update to the latest version immediately.
### Workarounds
* **Change Default Keys:** Immediately rotate the default `sk-1234` master key.
* **Enforce Authentication:** Ensure the `LITELLM_MASTER_KEY` is set to a strong, unique value and that authentication is explicitly required.
* **Disable Unused Features:** Disable MCP and custom code guardrails if they are not strictly necessary for operations.
* **Network Restricting:** Place LiteLLM instances behind a VPN or firewall to prevent public internet exposure.
## Detection
* **Indicators of Compromise:**
* Log entries showing successful MCP session creation with unrecognized Bearer tokens.
* Unexpected Python execution or changes in the `guardrail_endpoints.py` configuration.
* Outbound requests from the LiteLLM host to internal metadata URLs (e.g., `169.254.169.254`).
* **Detection Methods:** Monitor for public-facing LiteLLM instances using automated scanners; audit configuration files for default credentials.
## References
* [Wiz Blog: Off Guard - Breaking LiteLLM](https://www.wiz.io/blog/off-guard-breaking-litellm-from-authentication-bypass-to-cloud-compromise)
* [DEF CON 34 Speaker Presentation](https://defcon.org/html/defcon-34/dc-34-speakers.html#content_66651)
* [LiteLLM Official Documentation](https://www.litellm.ai/)