CVE-2026-59822: Wiz: Nearly 1 in 10 Internet-Facing LiteLLM Gateways Accepted sk-1234; MCP Auth Bypass Lands on CISA KEV

Wiz Research published on 9 September 2026 (picked up by The Hacker News on 10 September) a scan of 3,074 internet-facing LiteLLM gateways in which 294 (9.6%) accepted sk-1234 — the example master key in LiteLLM's own setup docs — and 191 of those had no key configured at all and would accept anything. The master key is full admin: provider API keys, proxied prompts, MCP-connected tools, and in Wiz's demo an unrestricted pass-through route pointed at instance metadata to retrieve cloud IAM credentials (including via IMDSv2 by smuggling required headers through x-pass- prefixes). That pass-through behavior has no CVE because LiteLLM's threat model trusts administrators; the operational failure is that the documented default erased that assumption. Separately, CVE-2026-59822 (MCP Streamable HTTP OAuth2-passthrough fallback that substitutes an empty UserAPIKeyAuth on failed key validation, fixed in 1.84.0) was added to CISA's Known Exploited Vulnerabilities catalog on 2 September 2026 after Wiz saw single-character Bearer probes against honeypots from 7 July — described as the first MCP-specific KEV entry. This is distinct from the earlier Host-header bypass already tracked in this feed as CVE-2026-49468.

You are affected if you run litellm <1.84.0. Versions 1.84.0 and later include the fix.

Rotate the master key off sk-1234 to a long random value immediately — that needs no upgrade and closes every Wiz path that depended on holding the default. Upgrade to 1.84.0 or later so CVE-2026-59822 and the other listed floors are closed. If you cannot upgrade yet, block /mcp/ and the MCP test endpoints POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list at the reverse proxy, and restrict guardrail CRUD/test routes to administrators. Audit pass-through endpoints, deny egress from the gateway container to link-local metadata addresses, and give the workload the narrowest cloud IAM role it can run with. If compromise is plausible, review the guardrails list for entries you did not create, restart to clear in-memory code, then rotate provider keys, the master key and the database credentials. Treat AI gateways as Tier-0 secret stores, not developer middleware.

Anomity inventories the AI agents, MCP servers, IDE extensions and skills on each developer device, so you can see which machines run litellm and which version, then enforce a policy on it.