---
id: 7559
title: "Off Guard: Breaking LiteLLM from authentication bypass to cloud compromise"
source_domain: wiz.io
source_url: "https://www.wiz.io/blog/off-guard-breaking-litellm-from-authentication-bypass-to-cloud-compromise"
published_at: "2026-09-09T16:06:00Z"
tags: ["cloud", "rce", "cloud-security", "litellm", "wiz", "llm-gateway", "cve-2026-59822", "cve-2026-59821"]
phying_url: "https://phying.com/item/7559"
lang: en
---

# Off Guard: Breaking LiteLLM from authentication bypass to cloud compromise

## Summary

Wiz Research: ~10% of 3,000 public LiteLLM instances accept the default key sk-1234 or no auth; chaining CVE-2026-59822 (MCP bypass) and CVE-2026-59821 reaches root RCE and cloud credential theft.

## Intelligence Metadata

- **Sources:** wiz.io
- **Published:** 2026-09-09T16:06:00Z
- **Original:** https://www.wiz.io/blog/off-guard-breaking-litellm-from-authentication-bypass-to-cloud-compromise
- **Phying News:** https://phying.com/item/7559