LiteLLM Vulnerabilities Allow Root Code Execution and Cloud Credential Theft
Multiple critical vulnerabilities in the open-source AI gateway LiteLLM could allow attackers to execute code as root and steal sensitive cloud credentials.
Newly disclosed security flaws in LiteLLM, a popular open-source gateway for AI models, present a significant risk to organizations by enabling attackers to gain root-level access within containers and steal cloud credentials. Researchers at Wiz.io discovered these vulnerabilities while scanning internet-facing LiteLLM instances, finding that a notable percentage were deployed with default credentials or lacked proper authentication.
The most severe issue, tracked as CVE-2026-59822, allows for an MCP (Master Control Program) authentication bypass. This vulnerability, which Wiz.io observed being exploited in the wild through their honeypot systems, enables attackers to establish a valid session with a connected MCP server using a minimal Bearer token. This access can then be leveraged to interact with databases, repositories, file systems, or workflow tools, potentially leading to broader system compromise.
Adding to the severity, CVE-2026-59821 affects LiteLLM's Custom Code Guardrails feature. This feature, intended to allow administrators to define custom policies for AI model requests, had a critical flaw where the endpoint for registering these guardrails did not enforce safety checks before execution. This allowed attackers with administrative access to execute arbitrary code, including commands with root privileges, within the LiteLLM container. While this RCE vulnerability requires administrative access, weak deployment settings or the aforementioned MCP bypass can effectively lower the barrier to exploitation.
CISA has recognized the urgency of CVE-2026-59822 by adding it to its Known Exploited Vulnerabilities (KEV) catalog, mandating prompt patching for affected organizations. The vulnerabilities impact LiteLLM versions prior to 1.82.0 for the guardrail flaw and prior to 1.84.0 for the MCP authentication bypass. Organizations are urged to identify their LiteLLM version, update immediately, and scrutinize older containers or test instances for potential exposure.
Beyond direct code execution, the compromised LiteLLM gateway can also expose cloud credentials. A pass-through feature, which allows forwarding requests to administrator-defined destinations, lacked proper administrator checks in versions prior to 1.83.0 (CVE-2026-35029). This misconfiguration, combined with administrative access, could enable attackers to obtain temporary AWS IAM credentials or access other cloud metadata services, bridging the gap to sensitive cloud resources.
The implications of these flaws extend to the broader landscape of AI infrastructure security. Exposed AI gateways like LiteLLM can serve as a pivot point for attackers, granting them access to valuable API keys, internal data, and the ability to launch costly resource misuse attacks. The pattern of credential theft and unauthorized access via exposed AI services is a growing concern, highlighted by incidents like LLMjacking and the compromise of AI model evaluator METR.
To mitigate these risks, organizations should replace default credentials with strong, unique master keys, audit guardrail configurations, and restrict the use of the pass-through feature. Implementing least-privilege principles for workload identities, restricting outbound traffic from containers, and removing management interfaces from public access are crucial steps. If vulnerable instances may have been accessed, rotating cloud credentials and reviewing logs for suspicious activity are essential remediation actions.