LiteLLM MCP auth bypass under active exploit

Wiz researchers Amitai Cohen and Yaara Shriki say attackers are exploiting an authentication bypass in BerriAI's LiteLLM Model Context Protocol endpoint. Their 9 September 2026 research blog names no victim organizations. CISA added the same bug, CVE-2026-59822, to its Known Exploited Vulnerabilities catalog on 2 September 2026 as "BerriAI LiteLLM Improper Authentication Vulnerability," with a federal remediation due date of 16 September 2026. CISA has not published a fuller advisory beyond the catalog entry.

CVE-2026-59822 lets an arbitrary Bearer token create a valid MCP session, including a token as thin as "Bearer a." LiteLLM fixed that path in v1.84.0 on 25 April 2026. Wiz first saw exploitation in its honeypot on 7 July 2026, one day before the CVE was published.

A second bug, CVE-2026-59821, is post-auth root-level remote code execution through custom code guardrails that reached exec and compile. That one was fixed in v1.82.0 on 25 February 2026. After those patches, the RCE path still needs admin rights, or a default or missing master key.

Wiz also says a pass-through endpoint can reach cloud metadata and IAM when that admin (or default) access is available. The researchers call that feature intended admin trust, not a separate CVE.

Of 3,074 public LiteLLM instances, 9.6% (294) accepted the default master key sk-1234 or required no authentication, and 6.2% (191) had no auth at all. Wiz says LiteLLM is present in about one third of cloud environments in its data. The default key still appears in LiteLLM docs and examples, and the research was presented earlier at DEF CON 34.

Some offers on this page may be paid placements or contain affiliate links.