AIR-2026-0187 · LiteLLM AI gateway: four security events in six months, including in-the-wild exploitation and MCP auth bypass

LiteLLM AI gateway: four security events in six months, including in-the-wild exploitation and MCP auth bypass

AIR-2026-0187 AIR record · 2026-08-wiz-litellm-ai-gateway-exploitation

A real party was affected. This incident caused actual consequences, not a demonstrated capability.

From the supporting source

LiteLLM, an AI gateway present in over a third of the cloud environments we monitor, had four separate security events in six months: a supply-chain compromise, an SQL injection vulnerability exploited in the wild, a privilege escalation chain and an authentication bypass.wiz.io

The record

Disclosed

2026-08-06

Vendor

BerriAI / LiteLLM

Product

LiteLLM AI gateway (incl. its MCP gateway)

Risk domain

Agent output quality › Hallucination

Also touches

Credential theft, Privilege escalation

System type

Generative model

Who acted

AI was the target — unauthenticated exploitation of the LiteLLM gateway in the wild

Attack surface

Agent framework

Autonomy level

Semi-autonomous

Initial vector

Unauthenticated network request

Impact type

Remote code execution, Unauthorized access, Credential theft, Cryptomining

Confidence

High

Submitted by

EAI Internal

Crosswalk

OWASP Agentic Top 10 (2026): ASI08 – Cascading Failures
MITRE ATLAS: AML.T0062 – Discover LLM Hallucinations
NIST AI RMF: MEASURE 2.5
EU AI Act: —
ISO/IEC: TR 24028; 24029-1
AIUC-1: D. Reliability
Scope: agent failure
Mitigation: Implement fact-checking via knowledge base/RAG; Tune model temperature/top-p.
Taxonomy: Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery

Blast radius

Wiz observes LiteLLM in over a third of the cloud environments it monitors

Capability abused

mcp_gatewaymodel_proxyingbackend_credential_holding

Curator notes

Wiz Threat Research H1 2026 report. CVE numbers (CVE-2026-59822 MCP gateway auth bypass; CVE-2026-42271 MCP test-endpoint command injection; CVE-2026-48710 Starlette host-header bypass) come from Wiz search-result summaries and were not each individually re-quoted from the cited page - treat the CVE list as lower confidence than the quoted claim. Wiz also reports unauthenticated MCP endpoints across hundreds of environments. Update 2026-09-21: CISA added CVE-2026-59822 to the Known Exploited Vulnerabilities catalog on 2026-09-02 (alert 'CISA Adds Seven Known Exploited Vulnerabilities to Catalog', which also lists CVE-2026-48710 Starlette and CVE-2026-49869 Kestra). Related later records: 2026-08-exposed-ai-infrastructure-exploitation-campaign (the in-the-wild exploitation campaign, Microsoft and Wiz) and 2026-09-wiz-litellm-offguard-exposure (default-key exposure measurement plus CVE-2026-59821).

Cite as

Enkrypt AI. "LiteLLM AI gateway: four security events in six months, including in-the-wild exploitation and MCP auth bypass". AIR, AIR-2026-0187. https://agentincident.vercel.app/i/AIR-2026-0187/ (accessed 2026-10-19).