What happened
Wiz (Google) published on 2026-10-14 a cluster of findings on LiteLLM: CVE-2026-59822 is an unauthenticated MCP auth bypass (verified NVD: CVSS 8.2 v3.1 / 8.8 v4.0, CWE-287/306, KEV-added with SSVC exploitation=active); CVE-2026-59821 lets a privileged user submit custom Python via the custom-code guardrail production path that runs without the test sandbox (CVSS 7.2). Wiz also flagged a default config that grants PROXY_ADMIN to anyone when auth is not set, and a pass-through endpoint URL-validation gap that could leak cloud credentials. 9.6% of scanned public instances were exposed.
Why it matters
An AI gateway is the chokepoint between applications and every model the org uses; compromise exposes all API keys, prompts, model traffic and any IAM-scoped cloud credentials the process holds. The confirmed in-the-wild exploitation (KEV) plus default-single-key or no-auth deployments make this the highest-priority AI-infrastructure fix in the window: unauthenticated entry followed by root-level code execution on model-serving infrastructure. Patch to >= 1.84.0, rotate the default key, and explicitly configure authentication.
Attack vector
Remote unauthenticated: the MCP Streamable HTTP endpoint accepts a fabricated Authorization header that triggers an OAuth2 passthrough fallback, replacing failed LiteLLM key validation with an empty UserAPIKeyAuth object so requests reach MCP tooling without a valid key. Once authenticated (or via default PROXY_ADMIN when auth is unconfigured), the custom-code guardrail create/update path does not apply test-endpoint sandboxing, so attacker-supplied Python executes in the proxy process — Wiz reports root-level RCE on the host.
Affected systems
BerriAI LiteLLM < 1.84.0 (CVE-2026-59822); < 1.82.0-stable (CVE-2026-59821 custom-code guardrails)
Mitigation
Upgrade LiteLLM to >= 1.84.0 (auth bypass) and >= 1.82.0-stable (guardrail sandbox). Replace the sk-1234 default key, force auth on exposed instances, restrict the UI/API to trusted networks. CISA BOD 26-04 due date for CVE-2026-59822 was 2026-09-16 — apply now. Vendor GHSA-7488-6r32-c95q / GHSA-72m8-9m7m-h278.