CVE
CVE-2026-59822
LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback
Exploitation IoCs 14
Domain 1710[.]rwlp[.]be
Domain crazyeltonproxy[.]top
Domain pool[.]hashvault[.]pro
Filename /tmp/.dbus-cache
Filename /tmp/.dbus-cache/gmon
Filename /tmp/amd64
Filename /tmp/x86_64
Filename guardrail_endpoints.py
Filename pass_through_endpoints.py
Filename user_api_key_auth_mcp.py
SHA-256 sk-1234
IP 185[.]62[.]1[.]8
IP 185[.]84[.]98[.]85
IP 94[.]26[.]106[.]29
MITRE ATT&CK TTPs 16
T1003 T1012 T1048 T1059 T1059.001 T1059.003 T1078 T1078.004 T1082 T1090 T1133 T1190 T1211 T1552 T1555 T1566
OS Credential Dumping
Credential Access
Query Registry
Discovery
Exfiltration Over Alternative Protocol
Exfiltration
Command and Scripting Interpreter
Execution
PowerShell
Execution
Windows Command Shell
Execution
Valid Accounts
Defense Evasion
Cloud Accounts
Defense Evasion
System Information Discovery
Discovery
Proxy
Command And Control
External Remote Services
Persistence
Exploit Public-Facing Application
Initial Access
Exploitation for Defense Evasion
Defense Evasion
Unsecured Credentials
Credential Access
Credentials from Password Stores
Credential Access
Phishing
Initial Access
Source Articles
Nearly 1 in 10 Exposed LiteLLM Gateways Accepted the Example "sk-1234" Admin Key
Wiz Research identified that nearly 1 in 10 internet-facing LiteLLM gateways accepted the default example admin key 'sk-1234', exposing critical cloud IAM credentials and API keys. Attackers with access to the master key can read all model provider API keys, execute code via misconfigured endpoints, and exploit pass-through routing to harvest cloud instance metadata. Multiple CVEs have been documented, including authentication bypasses and post-authentication code execution flaws, some of which are already being exploited in the wild to deploy cryptocurrency miners and extract sensitive data. Despite patches, many deployments remain vulnerable due to misconfigurations and unrotated default keys.
hacker-news Sep 10, 2026
Off Guard: Breaking LiteLLM from authentication bypass to cloud compromise
Multiple critical vulnerabilities were discovered in LiteLLM, a popular open-source LLM gateway, enabling authentication bypass, remote code execution, and cloud credential theft. CVE-2026-59822 allows unauthenticated access to MCP endpoints via a Bearer token bypass, while CVE-2026-59821 enables post-authentication root-level RCE through unsandboxed custom code guardrails. A default master key (sk-1234) is accepted by 9.6% of public instances, allowing attackers to achieve admin access and exploit these vulnerabilities. Additionally, pass-through endpoints can be abused to exfiltrate cloud metadata and IAM credentials, especially when combined with default or missing authentication.
wiz
CISA Adds Seven Exploited Flaws as Attackers Deploy Reverse Shells and Crypto Miners
CISA has added seven actively exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, including critical flaws in SonicWall SMA 1000, Sangoma Switchvox, JFrog Artifactory, Kludex Starlette, Kestra OSS, and Berri LiteLLM. Threat actors are exploiting these vulnerabilities to deploy reverse shells, execute arbitrary code, steal credentials, and deploy cryptocurrency miners. Exploitation of CVE-2026-83548 and CVE-2026-83549 in SonicWall devices has been confirmed, while CVE-2026-9586 and CVE-2026-82329 are being used to gain administrative access and conduct post-exploitation activities. Microsoft and Wiz report active exploitation of CVE-2026-42271 and CVE-2026-48710 in LiteLLM deployments, with attackers achieving remote code execution and stealing API keys, and CVE-2026-49869 in Kestra being used to establish reverse shells and deploy miners.
hacker-news Sep 3, 2026
Inside 90 days of attacks on AI infrastructure
Wiz Threat Research observed 90 days of sustained attacks against AI infrastructure through honeypots deployed across services like LiteLLM, Flowise, and LangChain. Attackers exploited vulnerabilities in MCP servers, including authentication bypass and command injection (CVE-2026-59822, CVE-2026-42271), to achieve remote code execution and deploy cryptominers. A second pattern involved blind prompt injection against AI agent frameworks, where attackers used out-of-band DNS callbacks to confirm execution and later fetch payloads from Pastebin. Post-exploitation activity was tailored to AI environments, including in-memory extraction of LiteLLM master keys, model enumeration, and use of environment-specific camouflage to hide malicious binaries.
wiz