Executive Summary
Security researchers have identified critical vulnerabilities in LiteLLM, a popular open-source AI gateway used in approximately one-third of cloud environments. These flaws, notably CVE-2026-59822 (MCP authentication bypass) and CVE-2026-59821 (Post-auth RCE), allow attackers to compromise AI infrastructure and move laterally into the surrounding cloud environment. As of mid-2026, CVE-2026-59822 has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog following observed active exploitation.
The attack chain involves bypassing authentication through flawed fallback logic in the Model Context Protocol (MCP) handler or exploiting default master keys (sk-1234) found in nearly 10% of internet-facing instances. Once authenticated—or using the bypass—attackers can exploit custom code guardrails to execute arbitrary Python code as root, or abuse the pass-through endpoint feature to exfiltrate AWS/cloud IAM credentials from the Instance Metadata Service (IMDS).
These findings highlight a significant shift in the cloud threat landscape where AI gateways have become Tier-1 security assets. Because LiteLLM centrally manages provider API keys and executes code as part of its core function, a compromise leads directly to high-impact LLMjacking, data exfiltration, and potential full cloud account takeover.