The exploit was one word long. Send a request to a LiteLLM server with the header Authorization: Bearer a, a token of a single letter, and the server hands back a valid session. Wiz found it while auditing the most widely deployed open source AI gateway in the world and published the details this week. CISA has since added it to its Known Exploited Vulnerabilities catalog, and Wiz says its honeypots caught it being used in the wild.
That matters more than a gateway bug normally would. LiteLLM puts one interface in front of more than a hundred model providers, and Wiz's telemetry puts it in about a third of cloud environments. It holds the API keys for every provider behind it, sees every prompt and response, and can reach internal tools over the Model Context Protocol. Compromise it and you have taken the company's AI infrastructure, and often the cloud account it runs in.
One character was the whole exploit
The bypass, CVE-2026-59822, lives in the handler guarding the MCP endpoint. It supports two callers: a LiteLLM API key, or an OAuth2 token forwarded upstream to a provider like GitHub. It tries the LiteLLM key first, and when validation fails it assumes the token must be an upstream one. The failed check throws a 401, the handler swallows it, and the request proceeds with an empty but fully valid authentication object. Wiz confirmed it exploitable across hundreds of internet facing instances. The whole protocol is then available, including calling tools with arbitrary arguments, and internal deployments are the ones with Jira, Slack and CI/CD pipelines on the other end.
Nearly one in ten was already wide open
Wiz scanned about 3,074 internet facing deployments and found 9.6 percent either accepted the default master key, the literal string sk-1234, or required no authentication. Before the patch, an instance with no master key set did not merely run unauthenticated: it assigned every incoming request the PROXY_ADMIN role. Not anonymous access. Anonymous administrator access.
Guardrails that ran as root
That default matters because of the second flaw, CVE-2026-59821. LiteLLM's custom code guardrails let an administrator submit Python that runs on every inference request, and the feature was designed with a sandbox. The test button in the web interface checked submitted code against a forbidden pattern list and stripped the Python builtins first. The registration endpoint that actually saves a guardrail did neither, so code sent there was compiled and executed immediately, with the full standard library and root privileges on the host. Wiz proved it with a guardrail that ran the id command and returned uid=0(root) as a policy violation message. The MCP bypass does not chain into this one, Wiz says, but on any instance in that 9.6 percent, admin is whoever asks.
Patch it, then change the master key
Pull request 22095 gated the guardrail endpoints behind PROXY_ADMIN, fixed the registration sandbox, and changed the default role to INTERNAL_USER. One finding got no fix and no CVE: pass through endpoints forward requests to arbitrary URLs without validating the destination, a clean route to the cloud metadata service at 169[.]254[.]169[.]254 and its instance credentials. Upgrading is necessary and not sufficient: an instance still running sk-1234, or no key, is still one where any stranger is an administrator. Take the gateway off the public internet, set a real master key, and audit which MCP servers are shared with everyone. IntelFusions covered LiteLLM before, when a supply chain compromise exposed secrets belonging to 2,500 companies and when researchers pulled provider keys out of an AI proxy's memory.
Wiz says it used Claude Code to hunt the codebase for user controlled input reaching an execution context, work first presented at DEF CON 34. AI infrastructure is now standardised enough to be worth auditing with AI, and worth attacking at scale.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.