AIR-2026-0231 · Off Guard: 1-in-10 internet-facing LiteLLM gateways accept the sk-1234 example key; post-auth root RCE via custom code guardrails (CVE-2026-59821)

Off Guard: 1-in-10 internet-facing LiteLLM gateways accept the sk-1234 example key; post-auth root RCE via custom code guardrails (CVE-2026-59821)

AIR-2026-0231 AIR record · 2026-09-wiz-litellm-offguard-exposure

From the supporting source

9.6% of 3,074 public instances (at the time of this research) accepted the default master key (sk-1234) or required no authentication at all.wiz.io

The record

Disclosed

2026-09-09

Vendor

BerriAI / LiteLLM

Product

LiteLLM AI gateway

Risk domain

Access control and permissions › Credential theft

Also touches

Privilege escalation

System type

Generative model

Who acted

AI was the target — measured exposure of AI gateways to default credentials and post-auth RCE

Attack surface

Agent framework

Autonomy level

Assistant

Initial vector

Default credential and unauthenticated access

Impact type

Remote code execution, Credential theft, Cloud iam compromise, Unauthorized access

Confidence

High

Submitted by

EAI Internal

Crosswalk

OWASP Agentic Top 10 (2026): ASI03 – Identity and Privilege Abuse
MITRE ATLAS: AML.T0012 – Valid Accounts
NIST AI RMF: MEASURE 2.7
EU AI Act: Article 13
ISO/IEC: TR 24028; 42001; 23894
AIUC-1: B. Security
Scope: tool failure
Mitigation: Use secure credential storage; Implement short-lived tokens.
Taxonomy: Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery

Blast radius

294 of 3,074 internet-facing LiteLLM gateways scanned (Feb 2026) accepted sk-1234 or no auth; LiteLLM present in ~1/3 of cloud environments

Capability abused

model_proxyingcustom_code_guardrailsmcp_gatewaypass_through_endpointbackend_credential_holding

Defense & remediation

Recorded defense

master key auth; guardrail test-endpoint sandbox and forbidden-patterns check

Guardrail kinds

Sandbox isolation, Authentication

Guardrail outcome

Silent

Fix shipped

LiteLLM 1.82.0-stable (RCE), 1.84.0 (MCP auth bypass); master key still defaults to sk-1234 as of Sept 2026

Curator notes

Wiz Research (Amitai Cohen, Yaara Shriki), 2026-09-09; previously presented at DEF CON 34. Measured-exposure + new RCE. NEW CVE-2026-59821 (post-auth root RCE via custom code guardrails registration path, which skips the test endpoint's sandbox). CVE-2026-59822 (MCP auth bypass) is already in AIR-2026-0187 - this record adds the sk-1234 exposure measurement and the guardrail RCE; treat AIR-2026-0187 as the umbrella. Note severity dispute: Wiz calls 59821 root RCE, LiteLLM's own advisory rates it Low/2.1 (GHSA-72m8-9m7m-h278). Pass-through-to-IMDS IAM theft has no CVE (vendor deems admin trusted). impact_realized false: a scan and PoCs, not a named victim (see the Microsoft campaign record for realized harm).

Cite as

Enkrypt AI. "Off Guard: 1-in-10 internet-facing LiteLLM gateways accept the sk-1234 example key; post-auth root RCE via custom code guardrails (CVE-2026-59821)". AIR, AIR-2026-0231. https://agentincident.vercel.app/i/AIR-2026-0231/ (accessed 2026-10-19).