CVE
CVE-2026-59821
LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks
Exploitation IoCs 4
Filename guardrail_endpoints.py
Filename pass_through_endpoints.py
Filename user_api_key_auth_mcp.py
SHA-256 sk-1234
MITRE ATT&CK TTPs 10
T1048 T1059.003 T1078 T1082 T1090 T1133 T1190 T1211 T1552 T1555
Exfiltration Over Alternative Protocol
Exfiltration
Windows Command Shell
Execution
Valid Accounts
Defense Evasion
System Information Discovery
Discovery
Proxy
Command And Control
External Remote Services
Persistence
Exploit Public-Facing Application
Initial Access
Exploitation for Defense Evasion
Defense Evasion
Unsecured Credentials
Credential Access
Credentials from Password Stores
Credential Access
Source Articles
Nearly 1 in 10 Exposed LiteLLM Gateways Accepted the Example "sk-1234" Admin Key
Wiz Research identified that nearly 1 in 10 internet-facing LiteLLM gateways accepted the default example admin key 'sk-1234', exposing critical cloud IAM credentials and API keys. Attackers with access to the master key can read all model provider API keys, execute code via misconfigured endpoints, and exploit pass-through routing to harvest cloud instance metadata. Multiple CVEs have been documented, including authentication bypasses and post-authentication code execution flaws, some of which are already being exploited in the wild to deploy cryptocurrency miners and extract sensitive data. Despite patches, many deployments remain vulnerable due to misconfigurations and unrotated default keys.
hacker-news Sep 10, 2026
Off Guard: Breaking LiteLLM from authentication bypass to cloud compromise
Multiple critical vulnerabilities were discovered in LiteLLM, a popular open-source LLM gateway, enabling authentication bypass, remote code execution, and cloud credential theft. CVE-2026-59822 allows unauthenticated access to MCP endpoints via a Bearer token bypass, while CVE-2026-59821 enables post-authentication root-level RCE through unsandboxed custom code guardrails. A default master key (sk-1234) is accepted by 9.6% of public instances, allowing attackers to achieve admin access and exploit these vulnerabilities. Additionally, pass-through endpoints can be abused to exfiltrate cloud metadata and IAM credentials, especially when combined with default or missing authentication.
wiz