Researchers Detail LiteLLM Authentication Bypass, Root-Level RCE and Cloud Credential Theft
Summary
Wiz researchers found LiteLLM authentication weaknesses and exploitable attack paths to MCP access, root-level code execution, and cloud credentials. Patches are available; the MCP bypass has been observed exploited and is listed in CISA’s KEV catalog.
Key points
- A scan of 3,074 public LiteLLM instances found 9.6% accepted the default master key or had no authentication.
- CVE-2026-59822 let arbitrary Bearer tokens establish MCP sessions; Wiz observed exploitation in its honeypots, and CISA added it to the KEV catalog.
- CVE-2026-59821 allowed authenticated admins to execute custom guardrail code as root; weak or missing authentication could make the path effectively pre-authentication on vulnerable deployments.
- When authentication was not configured, LiteLLM assigned requests the PROXY_ADMIN role by default; default credentials also exposed configured provider API keys.
- Authenticated admins could use unvalidated pass-through URLs to reach cloud metadata endpoints and obtain IAM credentials; the article says this behavior was not fixed as a vulnerability.
- LiteLLM released fixes, including versions 1.82.0 and 1.84.0; a separate pass-through configuration access issue was fixed in v1.83.0.
- Recommended measures include setting a strong unique master key, auditing guardrails and pass-through routes, restricting container egress, and applying least-privilege IAM.
Article Details
- Attack Vectors
- MCP authentication bypass: an arbitrary Bearer token, including a single-character token, can establish an authenticated MCP session.
- Custom code guardrail registration can execute attacker-supplied Python code on the server; before the fix, this could provide root-level code execution when an attacker had sufficient access.
- An unchanged default master key (sk-1234) or missing authentication can expose administrative access and enable abuse of configured LLM provider API keys.
- Pass-through endpoints can forward requests to arbitrary URLs without URL validation, enabling an authenticated administrator to retrieve cloud instance IAM credentials from the AWS metadata service.
- Before v1.83.0, any authenticated user could configure pass-through endpoints because the configuration endpoint did not require the PROXY_ADMIN role.
- Defensive Notes
- Use a strong, unique master key and replace the default value sk-1234.
- Upgrade to patched LiteLLM versions: v1.82.0 fixed the custom-code guardrail RCE and sandbox issues, v1.84.0 fixed the MCP authentication bypass, and v1.83.0 fixed the pass-through configuration endpoint authorization issue.
- Review guardrails for unexpected entries and restart the process to clear memory.
- Audit pass-through endpoints and restrict container network egress.
- Apply least-privilege IAM roles, such as IRSA or equivalent.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 169[.]254[.]169[.]254 | AWS instance metadata service address used as the pass-through target to retrieve IAM credentials. |
MITRE ATT&CK
T1059.006 · PythonThe guardrail registration endpoint executes attacker-supplied Python code through exec(compile(...)); the article demonstrates an os.popen command.T1190 · Exploit Public-Facing ApplicationThe article describes exploitation of internet-facing LiteLLM vulnerabilities, including the MCP authentication bypass and custom-code guardrail RCE.T1550.001 · Application Access TokenThe article says an unchanged default master key can be used as the HS256 signing secret to forge proxy user sessions.T1552.005 · Cloud Instance Metadata APIAn administrator can configure a pass-through route to the AWS metadata service and retrieve IAM credentials.
CVE
CVE-2026-35029PR #22095 addressed the default role (changed from PROXY_ADMIN to INTERNAL_USER) and added PROXY_ADMIN checks to the guardrail endpoints. The config update endpoint was fixed separately in v1.83.0 (CVE-2026-35029).CVE-2026-59821Post-auth root-level remote code execution via LiteLLM's custom code guardrails (CVE-2026-59821).CVE-2026-59822MCP authentication bypass via the MCP endpoint (CVE-2026-59822) - an arbitrary Bearer token can create a valid session; confirmed as exploitable across hundreds of Internet-facing instances.
Vendors
LiteLLMNearly 1 in 10 publicly accessible LiteLLM instances accept a default master key or require no authentication at all. We found this while scanning roughly 3,000 internet-facing deployments of the most popularWizpopular open-source AI gateways, present in approximately one-third of cloud environments according to Wiz data. LiteLLM can hold API keys for every configured LLM provider, process every prompt and response that
Products
AWS Bedrockthat provides a unified OpenAI-compatible API for over 100 LLM providers, including OpenAI, Anthropic, AWS Bedrock, Azure, and Google Vertex AI. Organizations route their LLM traffic through it so they can centrallyAzurea unified OpenAI-compatible API for over 100 LLM providers, including OpenAI, Anthropic, AWS Bedrock, Azure, and Google Vertex AI. Organizations route their LLM traffic through it so they can centrally manage theirClaude CodeWe decided to use Claude Code to work through LiteLLM's codebase, looking for features that accept user-controlled input and pass it to an execution context. We found multiple issues, as detailed below.Google Vertex AIAPI for over 100 LLM providers, including OpenAI, Anthropic, AWS Bedrock, Azure, and Google Vertex AI. Organizations route their LLM traffic through it so they can centrally manage their API keys,LiteLLMNearly 1 in 10 publicly accessible LiteLLM instances accept a default master key or require no authentication at all. We found this while scanning roughly 3,000 internet-facing deployments of the most popularWiz ASMWiz ASM discovers shadow LiteLLM deployments that may have been stood up outside of your standard provisioning process.Wiz Runtime SensorWiz Runtime Sensor detects anomalous code execution within LiteLLM containers, such as unexpected process spawning from the Python runtime.Wiz Threat Intel CenterWiz customers can use the pre-built queries and advisory in the Wiz Threat Intel Center to search for relevant instances in their environment.Wiz Vulnerability ScannerWiz Vulnerability Scanner detects vulnerable LiteLLM versions in container images and running workloads.