---
title: "LiteLLM Proxy: Three Exploited Flaws in CISA KEV"
url: https://erroneo.us/security/briefs/litellm-proxy-mcp-auth-bypass-kev/
description: "LiteLLM Proxy MCP auth bypass CVE-2026-59822 joined CISA KEV Sep 2, after a SQLi and command injection. Upgrade to 1.84.0+ and rotate stored keys."
type: security-brief
section: "Security Digest"
date_published: 2026-09-02
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Patch this week"
cves: ["CVE-2026-59822", "CVE-2026-42208", "CVE-2026-42271", "CVE-2026-59821"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# LiteLLM Proxy: Three Exploited Flaws in CISA KEV

**Verdict: Patch this week.** If you run a self-hosted LiteLLM Proxy older than 1.84.0, upgrade now and treat the provider keys it holds as possibly exposed; SDK-only users are not affected.

- **Who must act:** Operators of self-hosted LiteLLM Proxy (AI gateway) deployments, especially any reachable from the internet or from broad internal networks, and anyone still using the default sk-1234 master key.
- **Who can relax:** Projects that only import the litellm Python SDK as a client library and do not run the proxy server, and proxies already on 1.84.0 or later with a strong master key.
- **Affected:** LiteLLM Proxy < 1.84.0 (CVE-2026-59822, MCP auth bypass); LiteLLM >= 1.81.16, < 1.83.7 (CVE-2026-42208, SQL injection); LiteLLM >= 1.74.2, < 1.83.7 (CVE-2026-42271, command injection); LiteLLM < 1.82.0-stable (CVE-2026-59821, guardrail code execution)
- **Fixed:** LiteLLM 1.84.0 or later (covers all four)
- **CVEs:** CVE-2026-59822, CVE-2026-42208, CVE-2026-42271, CVE-2026-59821
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Upgrade the proxy to 1.84.0 or later (pin an exact version and verify hashes or image digest).
2. If you cannot upgrade, block /mcp/ and /mcp-rest/test/* at the reverse proxy and set general_settings.disable_error_logs: true.
3. Replace any default master key (sk-1234) and never run the proxy without a master key.
4. Do not expose the admin UI or management API to the internet; restrict to a VPN or allowlist.
5. Rotate provider API keys, virtual keys and the DATABASE_URL password if the proxy was exposed while vulnerable.
6. Review guardrails, pass-through endpoints and users for entries you did not create.

### How to check if you are affected

- Check the running version: pip show litellm inside the container or the version shown in the proxy UI and /health endpoints.
- Search access logs for unauthenticated requests to /mcp/ endpoints, POSTs to /mcp-rest/test/connection, or unusual Authorization header values on /chat/completions.
- Audit LiteLLM users, keys and guardrails for unknown entries, and cloud logs for use of the provider keys from unfamiliar IPs.

## What happened

LiteLLM Proxy is a self-hosted "AI gateway" that holds an organization's upstream LLM provider keys and hands out virtual keys to apps and users. In 2026 it collected three entries in the [CISA Known Exploited Vulnerabilities catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog). The most recent, added September 2, 2026, is [CVE-2026-59822](https://nvd.nist.gov/vuln/detail/CVE-2026-59822). In proxies older than 1.84.0, the MCP Streamable HTTP endpoint accepted any made-up Bearer token. A failed key check fell through to an OAuth2 passthrough path that substituted an empty auth object. Per the [advisory](https://github.com/BerriAI/litellm/security/advisories/GHSA-7488-6r32-c95q) (CVSS 4.0 8.8), that let an unauthenticated attacker list and call whatever MCP tools the proxy had configured, and reach the services behind them.

The two earlier KEV entries:

- [CVE-2026-42208](https://github.com/BerriAI/litellm/security/advisories/GHSA-r75f-5x8p-qvmc) (CVSS 9.3, added to KEV May 8). An unauthenticated SQL injection through the `Authorization` header on ordinary routes such as `/chat/completions`, which exposes the proxy database and the credentials stored in it.
- [CVE-2026-42271](https://github.com/BerriAI/litellm/security/advisories/GHSA-v4p8-mg3p-g94g) (added June 8). Lets any holder of a low-privilege key run OS commands through the MCP stdio "test connection" endpoints.

Both were fixed in 1.83.7. [Wiz's research](https://wiz.io/blog/off-guard-breaking-litellm-from-authentication-bypass-to-cloud-compromise) adds CVE-2026-59821, a guardrail sandbox escape fixed in 1.82.0. Wiz also reports that the default `sk-1234` master key doubles as the JWT signing secret: 9.6% of 3,074 instances it scanned accepted that key, and 6.2% required no auth at all.

## Who is affected

This affects only deployments that run the **proxy server** (`litellm --config` or the `ghcr.io/berriai/litellm` images) on a version below 1.84.0. Apps that import `litellm` as a client SDK do not expose these endpoints. The MCP bypass matters most where MCP servers are configured, because those tools often reach internal systems, databases or SaaS APIs.

## Do you really need to act?

**Yes, if you run the proxy and are behind.** Exploitation is confirmed. Wiz saw CVE-2026-59822 exploited in its honeypots on July 7, 2026, and CISA set a September 16 remediation deadline for federal agencies. An AI gateway is a high-value target. One foothold yields a whole organization's provider keys, which attackers resell or burn on "LLMjacking." LiteLLM's own [October 21 incident report](https://docs.litellm.ai/blog/security-incident-oct-21-2026) says an unexpected user on an internally exposed LiteLLM deployment, possibly via "a recently patched vulnerability," was the likely starting point for the supply-chain compromise of release 1.107.0. Root cause is not confirmed as of October 21. The lesson stands either way: internal-only does not mean safe. If your proxy is on 1.84.0 or later, has a strong master key and an admin plane that is not publicly reachable, you have done the important work.

## What to do now

1. Upgrade to 1.84.0 or later and pin an exact, verified version. Do **not** install 1.107.0, the malicious release from October 21. 1.106.2 was the last known-good release at that time.
2. If you can't upgrade today, block `/mcp/` and `/mcp-rest/test/*` at your ingress, and set `general_settings: disable_error_logs: true`, which the 42208 advisory gives as a workaround.
3. Replace any default or weak `LITELLM_MASTER_KEY`, and make sure the proxy never runs without one.
4. Restrict the admin UI and management routes to a VPN or allowlist, and limit container egress, including to the cloud metadata service.
5. If the proxy was reachable while vulnerable, rotate the upstream provider keys, master and virtual keys, and the `DATABASE_URL` credentials.

## How to tell if you were hit

Check the version with `pip show litellm` inside the running container. In access logs, look for:

- MCP requests from unknown clients.
- Calls to `/mcp-rest/test/connection`.
- Odd quoting or SQL fragments in `Authorization` headers.

In LiteLLM itself, audit users, keys, guardrails and pass-through routes for anything you did not create; Wiz recommends restarting after removing rogue guardrails. On the provider side, check usage dashboards and cloud audit logs for spikes or calls from unfamiliar networks.

## Timeline

- Apr 20, 2026 — The CVE-2026-42208 SQL injection advisory is published (fixed in 1.83.7). The command-injection advisory follows on April 21.
- May 8, 2026 — CISA adds CVE-2026-42208 to KEV. CVE-2026-42271 follows on June 8.
- Jul 7, 2026 — Wiz observes CVE-2026-59822 exploitation. The CVEs are published on July 8.
- Sep 2, 2026 — CISA adds CVE-2026-59822 to KEV, with a due date of September 16.
- Oct 21, 2026 — The LiteLLM supply-chain incident report cites a likely internal deployment compromise as the initial access.

## Sources

1. [CISA — Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
2. [LiteLLM / GitHub — GHSA-7488-6r32-c95q: MCP authentication bypass (CVE-2026-59822)](https://github.com/BerriAI/litellm/security/advisories/GHSA-7488-6r32-c95q)
3. [LiteLLM / GitHub — GHSA-r75f-5x8p-qvmc: SQL injection in proxy API key verification (CVE-2026-42208)](https://github.com/BerriAI/litellm/security/advisories/GHSA-r75f-5x8p-qvmc)
4. [LiteLLM / GitHub — GHSA-v4p8-mg3p-g94g: command execution via MCP stdio test endpoints (CVE-2026-42271)](https://github.com/BerriAI/litellm/security/advisories/GHSA-v4p8-mg3p-g94g)
5. [NVD — CVE-2026-59822](https://nvd.nist.gov/vuln/detail/CVE-2026-59822)
6. [Wiz — Off Guard: Breaking LiteLLM from authentication bypass to cloud compromise](https://wiz.io/blog/off-guard-breaking-litellm-from-authentication-bypass-to-cloud-compromise)
7. [LiteLLM — Security incident, October 21, 2026](https://docs.litellm.ai/blog/security-incident-oct-21-2026)

---
Source page: https://erroneo.us/security/briefs/litellm-proxy-mcp-auth-bypass-kev/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt