What happened
Wiz published detailed research on Sept 9, 2026 documenting a full attack chain in LiteLLM: an MCP authentication bypass (CVE-2026-59822, already CISA KEV-listed and observed exploited against Wiz honeypots), a post-authentication root-level RCE via custom-code guardrails (CVE-2026-59821), pervasive default-credential exposure across scanned public instances, and an unvalidated cloud-metadata pass-through path that received no CVE and remains unfixed.
Why it matters
LiteLLM sits at the center of many organizations' AI infrastructure, proxying model traffic and holding cloud provider credentials; this chain lets an attacker go from a fabricated bearer token to root code execution and cloud-account compromise, and Wiz confirms in-the-wild exploitation attempts, making it an active operational threat rather than theoretical.
Attack vector
An attacker submits an arbitrary/fabricated Bearer token to LiteLLM's MCP Streamable HTTP endpoint; a faulty OAuth fallback treats failed key validation as an empty-but-authenticated object, granting a valid MCP session and access to exposed MCP tools. Separately, the custom-code-guardrail feature executes administrator-submitted Python via exec(), enabling post-auth root RCE, and an unvalidated pass-through endpoint can be abused to reach cloud instance metadata and steal IAM credentials.
Affected systems
LiteLLM proxy/gateway — MCP auth bypass fixed in v1.84.0; custom-guardrail RCE (CVE-2026-59821) fixed in v1.82.0
Mitigation
Upgrade to LiteLLM v1.84.0+ (MCP auth bypass) and v1.82.0+ (guardrail RCE); replace default sk-1234 master keys; audit custom guardrails and pass-through endpoints; restrict egress and apply least-privilege IAM. CVE-2026-59822 is in CISA KEV (added Sept 2, 2026, federal deadline Sept 16).