Open-source LiteLLM is facing serious security vulnerabilities that could allow attackers to run commands as root inside containers and extract cloud credentials. Researchers discovered gaps in authentication and guardrail features that, in weakly configured deployments, turn what’s meant to be a safe AI gateway into a high-risk entry point.
Widespread Misconfigurations Outside Exposure, Default Keys
Investigators from Wiz scanned over 3,000 internet-facing LiteLLM instances and found that nearly 10%—specifically 294—either accepted the default master key or had no authentication enabled at all. Such oversights are particularly dangerous when systems are internet-exposed or still using example credentials that should have been replaced. The issue known as MCP authentication bypass (CVE-2026-59822) has already been observed in the wild via honeypot testing. In fact, one government authority added this weakness to its list of actively exploited vulnerabilities on September 2, 2026.
Guardrails Weakness Enables Remote Code Execution
One major risk lies in the Custom Code Guardrails feature, which is designed to let administrators inject Python-like policies around model requests. Before versions 1.82.0, guardrails could be registered without the safety checks applied elsewhere, enabling code to execute immediately—and even grant root access within the container. This code-execution flaw (CVE-2026-59821) depends on having administrator privileges or, alternatively, lax configurations like unchanged default credentials.
The bypass tied to MCP tokens offers a separate attack channel. A nearly empty Bearer token can create a valid session with the MCP server, enabling access to internal tools, file systems, or workflows—potentially without full administrative credentials. Patch versions 1.82.0 addressed guardrail registration flaws by enforcing admin roles and sandbox protections; version 1.84.0 fixed the authentication bypass. Users should check deployment versions and update immediately where needed.
How Cloud Credentials Are Put in Jeopardy
LiteLLM often handles provider API keys, communicates with internal services, and can interact with the cloud environment via its workload identity. When pass-through settings are misconfigured, it’s possible to send requests to internal resources, including cloud metadata endpoints—such as AWS’s metadata service—and obtain temporary credentials. Prior to version 1.83.0, configuration updates for pass-through routes lacked administrator checks, making this attack vector particularly pernicious (tracked as CVE-2026-35029).
To limit risk, organizations should swap out example or default master keys, review custom guardrails for unexpected or dangerous entries, and clear any code lingering in memory by restarting instances. Restrict outbound container traffic, enforce least-privilege permissions for LiteLLM’s workload identity, and make sure management interfaces aren’t exposed to the public internet. Rotating cloud credentials and monitoring logs for abnormal admin activity or external requests are also critical defensive steps.
The research offers indicators of compromise like default credential strings (such as “sk-1234”), endpoints like “/mcp/”, “/guardrails”, and malformed HTTP headers or paths for pass-through config routes. Observing activity against cloud metadata URIs like “169.254.169.254/latest/” is especially suspicious.
These vulnerabilities underscore a broader issue: AI gateways are rapidly becoming as high-value—and high-risk—as traditional cloud infrastructure. Without robust safeguards, a single misconfigured component can turn into an attacker’s springboard.
What this means: LiteLLM’s flaws are a stark reminder that advanced AI tools still demand rigorous security discipline. As AI deployment accelerates across industries, even small configuration errors—default keys, missing authentication, lax guardrails—can unlock full system access. For organizations leveraging LiteLLM or similar platforms, urgent patching, tighter access control, and continuous auditing are essential to prevent potentially catastrophic breaches.
