← Back to feed
2026-09-11 Mcp SecurityLLMjacking TLP:CLEAR

CVE-2026-59822: CISA Lists LiteLLM MCP Auth Bypass; Wiz Saw Default sk-1234 On 9.6 Percent of Public Gateways

Date: 2026-09-11
Tags: mcp-security, llmjacking

Executive Summary

Wiz published on 2026-09-09 that LiteLLM's MCP Streamable HTTP path accepted an arbitrary Bearer token as an authenticated session, tracked as CVE-2026-59822 and fixed in 1.84.0. CISA added that CVE to the Known Exploited Vulnerabilities catalog on 2026-09-02, with a federal remediation date of 2026-09-16. Wiz also reported that 294 of 3,074 internet facing LiteLLM instances scanned in February 2026 accepted the documented example master key sk-1234 or had no auth at all. Upgrade to 1.84.0 or later, replace the master key, and hunt MCP initialize requests that present garbage tokens.

Campaign Summary

FieldDetail
Campaign / MalwareLiteLLM MCP authentication bypass CVE-2026-59822; related CVE-2026-59821 custom code guardrail RCE; default master key exposure. Not a named malware family
Actor / AttributionUnnamed operators. Wiz observed CVE-2026-59822 on honeypots. CISA listed the CVE as known exploited. Confidence none for a named group
TargetOrganizations running internet facing or internally reachable LiteLLM gateways with MCP enabled
VectorFabricated Authorization header on the MCP endpoint; unchanged example master key; unauthenticated PROXY_ADMIN on installs with no master key
StatusPatched in 1.84.0 for CVE-2026-59822. CISA KEV as of 2026-09-02. Default key guidance in LiteLLM docs still used sk-1234 as of Wiz's 2026-09-09 post
First ObservedWiz reported the RCE to maintainers 2026-02-18. Honeypot exploitation of CVE-2026-59822 on 2026-07-07. Public CVEs 2026-07-08. KEV 2026-09-02

Detailed Findings

According to Wiz, LiteLLM's MCP auth handler was written to pass unknown Bearer tokens through to upstream OAuth providers. When LiteLLM key validation returned 401 or 403, the handler substituted an empty UserAPIKeyAuth object and continued. Wiz said any Authorization header, including a single character token, was enough to obtain an mcp-session-id. That session could call MCP tools the gateway had configured. Wiz noted LiteLLM's allow_all_keys setting makes tools available to every user, including that empty credential.

The Hacker News reported the same Wiz scan: 3,074 Shodan visible gateways in February 2026, 294 accepting sk-1234 or no key, of which 191 had no key at all. A later August scan found more than 85,000 instances, which Wiz said were mostly honeypots or test systems and should not be compared to the February count. THN said CISA added CVE-2026-59822 on 2026-09-02 and that federal civilian agencies have until 2026-09-16.

Wiz also disclosed CVE-2026-59821: POST /guardrails compiled administrator supplied Python with exec and, on the registration path, did not apply the sandbox used by the test button. Wiz said that bug is post auth and does not follow from the MCP bypass alone. Combined with a default or missing master key on versions before 1.82.0, Wiz said the guardrail path was effectively pre auth root in the container. PR 22095 required PROXY_ADMIN, stripped builtins, and applied the forbidden pattern check on registration.

Wiz reported two further conditions that are configuration rather than CVEs. With no master key and no JWT, pre patch LiteLLM assigned PROXY_ADMIN to every request. The documented example master key sk-1234 is also the HS256 secret for session JWTs, so leaving it in place lets an outsider forge sessions. Wiz said pass through endpoints accept arbitrary target URLs with no private range checks, including cloud metadata, and that headers prefixed with x-pass- are forwarded with the prefix stripped, which defeats IMDSv2 token requirements. Wiz treated pass through as admin trusted design, not a vulnerability, but noted it becomes an IAM theft path when the admin secret is the example value. CVE-2026-35029 separately required PROXY_ADMIN on config updates in 1.83.0.

This feed already covered Wiz's 2026-09-07 honeypot note that chained CVE-2026-59822 with CVE-2026-42271 against LiteLLM like targets. This post covers the 2026-09-09 Off Guard write up, CISA's KEV listing, and the default master key scan. Do not collapse that honeypot chain with Microsoft's August 2026 LiteLLM cases, which Microsoft assessed as CVE-2026-42271 chained with CVE-2026-48710. Microsoft's observed miners and C2 remain under the 2026-09-03 control plane post.

Wiz listed presence of LiteLLM in about one third of cloud environments in its telemetry. No malicious package name, domain, IP, or hash was published for the KEV exploitation beyond the product itself. sk-1234 is a default credential, not an IOC.

MITRE ATT&CK Mapping

TechniqueIDContext
Exploit Public-Facing ApplicationT1190Unauthenticated MCP session via arbitrary Bearer token on /mcp/
Valid AccountsT1078Example master key sk-1234 or missing auth treated as admin
Unsecured Credentials: Cloud Instance Metadata APIT1552.005Pass through routes pointed at 169.254.169.254 after admin auth
Command and Scripting Interpreter: PythonT1059.006Custom code guardrails executed attacker Python on registration before 1.82.0
Steal Application Access TokenT1528Gateway holds provider keys and virtual keys for LLMjacking

IOCs

Domains

No domain IOCs published by source

Full URL Paths

No URL IOCs published by source

Splunk Format

No IOCs available for Splunk query

File Hashes

No hash IOCs published by source

Detection Recommendations

Inventory every LiteLLM process and container. Versions before 1.84.0 are in scope for CVE-2026-59822. Alert on MCP initialize to /mcp/ with Authorization values that are not issued LiteLLM keys, including one character and obviously random tokens, and on new mcp-session-id values from unauthenticated source nets. Search config and environment for LITELLM_MASTER_KEY or general_settings.master_key equal to sk-1234, and for proxies with no master key at all. Hunt POST /guardrails creating custom_code entries, unexpected pass through targets especially 169.254.169.254, and x-pass- header use. Rotate provider keys and virtual keys after any default key or unauthenticated admin period. If you cannot patch immediately, disable MCP routes at the reverse proxy. Do not denylist LiteLLM as a product name.

References