Critical LiteLLM Flaws Let Attackers Execute Code as Root, Steal Cloud Credentials

Key Takeaways

• Critical vulnerabilities in LiteLLM, an open-source AI gateway, could allow attackers to execute code as root and steal cloud credentials.
• The flaws, including CVE-2026-59822 (authentication bypass) and CVE-2026-59821 (arbitrary code execution), affect versions prior to 1.84.0 and 1.82.0, respectively.
• Researchers found nearly 10% of internet-facing LiteLLM instances were exposed due to default credentials or lack of authentication.
• Successful exploitation can lead to full compromise of the LiteLLM container, access to connected internal systems, and potential lateral movement within cloud environments.
• Patches are available in LiteLLM versions 1.82.0 (for code execution) and 1.84.0 (for authentication bypass).

Newly discovered security vulnerabilities within LiteLLM, a widely used open-source gateway for large language models, present a significant risk to organizations. These critical flaws could enable malicious actors to achieve root-level code execution within LiteLLM containers, access interconnected systems, and exfiltrate cloud credentials, potentially leading to broader compromise of an enterprise’s cloud infrastructure.

The severity of these issues is amplified when LiteLLM deployments are directly exposed to the internet or are configured with default master keys. As a central intermediary between applications, AI model providers, internal data sources, and automation tools, a compromised LiteLLM gateway can become a single point of failure, granting attackers deep access into an organization’s operational ecosystem.

Security researchers at Wiz.io uncovered these vulnerabilities during their analysis of publicly accessible LiteLLM installations. Their scan of 3,074 internet-facing instances revealed that a substantial 9.6% (294 instances) were configured with either the default master key or had no authentication mechanisms enabled, leaving them highly vulnerable. As Wiz.io said in a report, the MCP authentication bypass, identified as CVE-2026-59822, has already been observed in the wild via honeypot systems. The urgency for patching heightened when CISA added this flaw to its Known Exploited Vulnerabilities catalog on September 2.

LiteLLM Flaws Let Attackers Execute Code

Custom Code Guardrails Vulnerability (CVE-2026-59821)

One of the critical vulnerabilities, CVE-2026-59821, resides in LiteLLM’s Custom Code Guardrails feature. This functionality allows administrators to define Python-like policies that wrap around model requests. Prior to the fix, the endpoint used for registering these guardrails lacked the necessary safety checks that were present in the testing interface. This oversight permitted any submitted code to execute immediately.

Exploitation of this flaw could grant an attacker root-level command execution within the LiteLLM container, provided they have administrative access. Such access could be obtained through instances lacking proper authentication, those still using the default master key, or other administrative weaknesses. This scenario bears resemblance to an earlier LiteLLM administrative API vulnerability that impacted configuration controls.

While this Remote Code Execution (RCE) typically requires an authenticated administrator and cannot be triggered solely via the MCP bypass, misconfigured deployment settings can easily remove this authentication barrier. Specifically, LiteLLM releases prior to version 1.82.0, if configured with an unchanged default credential, could make this code execution path readily available without standard authentication protocols.

MCP Authentication Bypass (CVE-2026-59822)

The MCP authentication bypass (CVE-2026-59822) offers a distinct entry point for attackers. This vulnerability allows an attacker to establish a valid session with a connected MCP server using a trivial Bearer token. Once a session is established, an intruder could potentially leverage available database, repository, file-system, or workflow tools connected to the MCP server. This particular issue differs from other LiteLLM RCE exploits observed in the wild, which involved alternative vulnerability chains.

LiteLLM addressed the guardrail vulnerabilities in release 1.82.0 by implementing mandatory administrator roles and integrating sandbox protections during the guardrail registration process. The MCP authentication bypass was subsequently fixed in version 1.84.0. Organizations are strongly advised to identify their current LiteLLM version, apply the necessary patches promptly, and scrutinize their environments for any exposed older containers or test instances.

Cloud Keys at Risk

These findings underscore the critical need to secure AI gateways with the same rigor applied to other highly privileged cloud services. LiteLLM instances often store sensitive API keys for various providers and communicate with internal systems. Furthermore, their associated workload identities can possess extensive permissions, including the ability to invoke models, read secrets, or interact with other cloud services.

A “pass-through” feature within LiteLLM allows requests to be forwarded to administrator-defined destinations without validating whether the target is an internal address or a cloud metadata service. In the event of administrative access compromise, an attacker could exploit this feature to acquire temporary AWS IAM credentials. This is not a standalone vulnerability but becomes highly dangerous when combined with failed access controls. A separate issue, CVE-2026-35029, affecting versions prior to 1.83.0, involved the configuration-update route for pass-through settings also lacking an administrator check. This pattern of exposed gateways leading to credential theft, persistence, and resource misuse is a recurring theme in AI infrastructure attacks.

What You Should Do

• Patch Immediately: Upgrade LiteLLM instances to version 1.82.0 or later for protection against CVE-2026-59821, and to version 1.84.0 or later for CVE-2026-59822.
• Change Default Credentials: Replace any default master keys (e.g., sk-1234) with strong, unique credentials immediately.
• Review and Audit Configurations: Scrutinize all custom guardrails for unexpected or malicious entries. Audit pass-through settings to ensure they do not expose internal services or metadata endpoints.
• Restrict Network Access: Remove management interfaces from the public internet. Limit access to LiteLLM instances and their administrative controls to trusted networks and authenticated administrators.
• Implement Least Privilege: Apply the principle of least privilege to IAM permissions associated with LiteLLM workload identities, ensuring they only have access to resources absolutely necessary for their function.
• Monitor and Log: Rotate all provider keys and cloud credentials if any vulnerable instance was exposed. Review logs for suspicious administrative activity and unusual outbound network requests.
• Restart Services: Restart LiteLLM processes after applying patches to ensure any retained malicious code in memory is cleared.

Indicators of Compromise (IoCs)

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.