LiteLLM was built to centralize access to AI models. Wiz Research has shown that the same position can turn the gateway into a route into the wider cloud environment.
Wiz found an authentication bypass, root-level remote code execution and a separate path to cloud credentials in the open-source gateway. Its Sept. 9 analysis, first presented at DEF CON 34, argued that AI gateways should be treated as Tier-1 security assets rather than developer tooling.
LiteLLM offers a common interface to more than 100 model providers and can hold the API key for each. Wiz said its own data put LiteLLM in roughly a third of cloud environments, and the gateway can also reach internal tools through the Model Context Protocol (MCP).
Wiz scanned 3074 publicly reachable instances in February 2026. Of those, 9.6% accepted the default master key and 6.2% required no authentication at all, and where no master key was set LiteLLM granted every request full administrator rights.
The default key is the more durable problem. Wiz said LiteLLM still ships with sk-1234 as its master key on Docker Compose and pip installs, and its documentation uses it throughout the quickstart guides.
CVE-2026-59822 is the authentication bypass, caused by fallback logic that could not distinguish a legitimate upstream OAuth token from a worthless one. Wiz found a single-character bearer token opened a valid MCP session, reaching any tool the organization had configured for open access.
Why the Two Flaws Do Not Chain
CVE-2026-59821 is the code execution issue. The registration path for custom code guardrails applied neither the sandboxing nor the pattern checks used by the test path, and submitted Python ran the moment a guardrail was registered rather than waiting for an inference request.
The code execution flaw needs an administrator, and Wiz said the MCP bypass does not supply one: it reaches MCP servers only. What does is an unchanged default key on a version before 1.82.0, which Wiz said yields root in the container in one request.
LiteLLM separately lets administrators create pass-through routes to arbitrary URLs with no validation against private ranges or cloud metadata endpoints. Wiz called that working as intended where administrators are trusted, but said header forwarding also defeats IMDSv2, making it a credential theft path once that trust breaks.
The code execution issue was fixed in 1.82.0 in February and the MCP bypass in 1.84.0 in April. Wiz saw the bypass exploited in its honeypots on July 7, a day before the CVE was published and ten weeks after the patch shipped, and CISA added it to the Known Exploited Vulnerabilities catalog on Sept. 2.
Wiz used Claude Code to work through the codebase, a case of AI finding the flaws rather than being the attack surface.
