Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Off Guard: Breaking LiteLLM from authentication bypass to cloud compromise

wiz.io | vulnerability | #cloud | #rce | #cloud-security | #litellm | #wiz | #llm-gateway | #cve-2026-59822 | #cve-2026-59821

Summary

Wiz Research: ~10% of 3,000 public LiteLLM instances accept the default key sk-1234 or no auth; chaining CVE-2026-59822 (MCP bypass) and CVE-2026-59821 reaches root RCE and cloud credential theft.
Published
Collected

original ↗

Related coverage

  1. Wiz achieves GovRAMP High Authorization (wiz.io)
  2. CVE-2022-22947: Spring Cloud Gateway Code Injection Vulnerability (blog.viettelcybersecurity.com)
  3. Introducing Continuous Vulnerability Assessment: Real-Time Defense for the AI Threat Era (wiz.io)
  4. Inside the vault: how financial institutions protect their cloud environments (wiz.io)
  5. GAO Study Reveals: Government Faces Challenges with Continuous Monitoring (wiz.io)
  6. Fortify your cloud security with Wiz as it integrates with Microsoft Sentinel (wiz.io)

back