{
 "public_id": "AIR-2026-0231",
 "incident_id": "2026-09-wiz-litellm-offguard-exposure",
 "date_disclosed": "2026-09-09",
 "date_occurred": null,
 "title": "Off Guard: 1-in-10 internet-facing LiteLLM gateways accept the sk-1234 example key; post-auth root RCE via custom code guardrails (CVE-2026-59821)",
 "class": "responsible_disclosure",
 "attack_surface": "agent_framework",
 "initial_vector": "default_credential_and_unauthenticated_access",
 "agent_capability_abused": [
  "model_proxying",
  "custom_code_guardrails",
  "mcp_gateway",
  "pass_through_endpoint",
  "backend_credential_holding"
 ],
 "target_product": "LiteLLM AI gateway",
 "target_vendor": "BerriAI / LiteLLM",
 "autonomy_level": "assistant",
 "impact_realized": false,
 "impact_type": [
  "remote_code_execution",
  "credential_theft",
  "cloud_iam_compromise",
  "unauthorized_access"
 ],
 "blast_radius": "294 of 3,074 internet-facing LiteLLM gateways scanned (Feb 2026) accepted sk-1234 or no auth; LiteLLM present in ~1/3 of cloud environments",
 "cve": [
  "CVE-2026-59821",
  "CVE-2026-59822"
 ],
 "taxonomy": {
  "owasp_asi": [
   "ASI05",
   "ASI03"
  ],
  "mitre_atlas": [],
  "labels": [
   "default_credential",
   "measured_exposure",
   "remote_code_execution",
   "ai_gateway",
   "cloud_metadata",
   "mcp_gateway"
  ]
 },
 "defense_present": "master key auth; guardrail test-endpoint sandbox and forbidden-patterns check",
 "defense_bypassed": true,
 "fix_shipped": "LiteLLM 1.82.0-stable (RCE), 1.84.0 (MCP auth bypass); master key still defaults to sk-1234 as of Sept 2026",
 "primary_sources": [
  "https://www.wiz.io/blog/off-guard-breaking-litellm-from-authentication-bypass-to-cloud-compromise",
  "https://thehackernews.com/2026/09/nearly-1-in-10-exposed-litellm-gateways.html"
 ],
 "verified_quote": "9.6% of 3,074 public instances (at the time of this research) accepted the default master key (sk-1234) or required no authentication at all.",
 "confidence": "high",
 "notes": "Wiz Research (Amitai Cohen, Yaara Shriki), 2026-09-09; previously presented at DEF CON 34. Measured-exposure + new RCE. NEW CVE-2026-59821 (post-auth root RCE via custom code guardrails registration path, which skips the test endpoint's sandbox). CVE-2026-59822 (MCP auth bypass) is already in AIR-2026-0187 - this record adds the sk-1234 exposure measurement and the guardrail RCE; treat AIR-2026-0187 as the umbrella. Note severity dispute: Wiz calls 59821 root RCE, LiteLLM's own advisory rates it Low/2.1 (GHSA-72m8-9m7m-h278). Pass-through-to-IMDS IAM theft has no CVE (vendor deems admin trusted). impact_realized false: a scan and PoCs, not a named victim (see the Microsoft campaign record for realized harm).",
 "risk_category": "security_fraud",
 "risk_secondary": [],
 "risk_subcategory": "Credential & Secret Theft",
 "risk_sub_secondary": [
  "Remote Code Execution & Sandbox Escape",
  "Unauthorized Access & Account Takeover",
  "Over-permissioned execution & lateral movement"
 ],
 "ai_entity": "generative",
 "agency": "ai_as_target",
 "agency_debatable": false,
 "agency_reason": "measured exposure of AI gateways to default credentials and post-auth RCE",
 "vector_family": "conventional_vulnerability",
 "vector_detail": "default_credential_and_unauthenticated_access",
 "guardrail_kind": [
  "sandbox_isolation",
  "authentication"
 ],
 "guardrail_outcome": "silent",
 "xrefs": {
  "aiid": [],
  "atlas": [],
  "cve": [
   "CVE-2026-59821",
   "CVE-2026-59822"
  ],
  "ghsa": []
 },
 "primary_asi": "ASI05",
 "agent_framework": "unknown",
 "model_provider": "unknown",
 "model_name": "",
 "detection_mechanism": "external_researcher",
 "tool_access": "unknown",
 "financial_loss_band": "unknown",
 "eai_category": "credential_theft",
 "eai_domain": "access_control_and_permissions",
 "eai_secondary": [
  "privilege_escalation"
 ],
 "eai_reason": "subcategory: Credential & Secret Theft",
 "asi_curated": [],
 "asi_scope": "in_scope",
 "asi_provenance": "rule",
 "asi_reason": "ASI05 (impact=code_exec); ASI03 (eai_category=credential_theft)",
 "submitted_by": "EAI Internal"
}