Breaking LiteLLM: From Auth Bypass to Cloud Compromise

Summary

LiteLLM, an open-source AI gateway proxy with roughly 95 million monthly PyPI downloads that centralizes credentials for 100+ LLM providers and is present in about one-third of cloud environments, was struck by a cascading series of critical 2026 vulnerabilities that collectively expose the enterprise API keys it is designed to manage. Because proxy-mode deployments concentrate every provider credential in one PostgreSQL-backed store and the proxy also executes server-side code and connects to internal tools via MCP, a single compromise yields the gateway's full credential inventory and often the surrounding cloud environment.^[0][53][60]

The campaign includes a March 2026 supply chain compromise (CVE-2026-33634, CVSS 9.4) attributed to TeamPCP, who abused a poisoned Trivy scanner running in LiteLLM's CI/CD to steal PyPI publishing tokens and ship trojanized LiteLLM packages v1.82.7 and v1.82.8; a pre-authentication SQL injection (CVE-2026-42208, CVSS 9.3); and a command-injection flaw in LiteLLM's MCP test endpoints (CVE-2026-42271) that, chained with a Starlette host header bypass (CVE-2026-48710), achieves unauthenticated RCE assessed at CVSS 10.0. Palo Alto Unit 42 independently documents TeamPCP's multi-stage supply chain attack on security infrastructure.^[0][52]

The scale of fallout is quantified: Hudson Rock independently obtained a 153GB archive of exfiltrated data comprising 433,909 files and attributed 118,829 CI runner dumps to 2,488 affected corporate domains, confirming credentials and configurations were harvested mid-execution from developer machines, production servers, and CI/CD pipelines worldwide.^[40]

Wiz's DEF CON 34 research further shows the exposure is not only theoretical: scanning roughly 3,000 internet-facing LiteLLM deployments, 9.6% of 3,074 public instances accepted the default master key (sk-1234) or required no authentication, making otherwise post-auth issues—including an MCP authentication bypass (CVE-2026-59822), a root-level RCE via custom code guardrails (CVE-2026-59821), an unauthenticated admin-by-default behavior, and a pass-through cloud-credential-theft vector—effectively pre-auth. CVE-2026-42271 and CVE-2026-59822 are both under active exploitation and listed in CISA's KEV catalog; organizations should upgrade to v1.83.10-stable, update Starlette, remove default credentials, and treat credentials on affected hosts as potentially compromised.^[0][60]

Attack chain

1. Toolchain compromise: TeamPCP compromised the Trivy open-source vulnerability scanner on March 19, 2026 and hijacked the Checkmarx KICS GitHub Action on March 21, 2026 as part of a coordinated campaign against the developer toolchain and security infrastructure.^[0][52]
2. Credential theft: LiteLLM's CI/CD pipeline depended on Trivy; when the poisoned Trivy tooling ran in that pipeline it was granted legitimate read access to the runner environment and exfiltrated LiteLLM's PyPI publishing tokens to attacker infrastructure.^[0][40]
3. Malicious package publication: Using the stolen publishing credentials, TeamPCP published trojanized LiteLLM versions v1.82.7 and v1.82.8 to PyPI on March 24, 2026; the packages were downloaded tens of thousands of times before PyPI quarantined them within roughly three hours.^[0][40]
4. Stealthy payload execution: The malicious code used a .pth Python startup hook, executing the moment the interpreter initialized even without an explicit LiteLLM import. The multi-stage payload harvested environment variables and local configuration files such as .kube/config and .aws/credentials, along with AI provider API keys, AWS/GCP/Azure metadata credentials, SSH private keys, and CI/CD tokens.^[0][40]
5. Lateral movement and persistence: The payload attempted lateral movement into Kubernetes clusters by enumerating accessible service account tokens and installed a persistent systemd backdoor that polled for further payloads over an encrypted channel, ensuring persistence even if the malicious package was removed.^[0][40]
6. Direct exploitation of the credential store: Separately, attackers targeted LiteLLM's credential store through a pre-authentication SQL injection (CVE-2026-42208) that lets any client reaching the proxy port extract virtual keys, provider credentials, and config secrets from PostgreSQL without authenticating.^[0]
7. Authentication bypass and default-credential abuse: Wiz found 9.6% of 3,074 public LiteLLM instances accepted the default master key sk-1234 or required no auth, and an unauthenticated admin-by-default behavior grants PROXY_ADMIN to all users when no auth is configured; combined with the MCP Gateway auth bypass (CVE-2026-59822), attackers gained privileged access to internet-exposed proxies, observed in honeypots using single-character bearer tokens.^[53][60]
8. Unauthenticated RCE and post-exploitation: Attackers chained the MCP command-injection flaw CVE-2026-42271 with the Starlette host header bypass CVE-2026-48710 to bypass authentication and achieve RCE on internet-exposed proxies; Wiz additionally demonstrated post-auth root-level RCE via custom code guardrails (CVE-2026-59821) and cloud-credential theft via the pass-through endpoint, enabling secret theft, direct database queries, backdoors, and pivoting to the surrounding cloud environment.^[0][60]

Disclosure timeline

Actor profile

TeamPCP

Threat actor group conducting a coordinated cascading supply chain campaign against the developer-toolchain and security-infrastructure ecosystem in mid-to-late March 2026, compromising Trivy and Checkmarx KICS and leveraging LiteLLM's dependency on Trivy to steal PyPI publishing tokens and ship trojanized LiteLLM packages. Payloads focused on credential harvesting (AI provider keys, cloud credentials, SSH keys, CI/CD tokens) via a .pth Python startup hook, Kubernetes lateral movement, and systemd persistence, indicating a focus on the aggregated credential value concentrated in AI gateways. Attribution is independently documented by Palo Alto Unit 42, and Hudson Rock has recovered the raw exfiltrated corpus tying the operation to 2,488 corporate domains.^[0][40][52]

How it works

CVE-2026-42208 (SQL injection): LiteLLM's authentication middleware passes the Authorization: Bearer token value directly into a SQL query without parameterization to look up the virtual key record. Because this lookup runs before the authorization decision, any client reaching the proxy port can inject arbitrary SQL and read high-value tables including LiteLLM_VerificationToken (virtual keys and master key), litellm_credentials (provider credentials), and litellm_config (environment variables and secrets).^[0]

CVE-2026-42271 (command injection): The MCP preview endpoints POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list accept a full MCP server configuration object, including the command, args, and env fields used by the stdio transport, and pass them directly to a subprocess on the proxy host with no validation or sandboxing, running with the full privileges of the LiteLLM process.^[0]

Chained exploitation: CVE-2026-42271 alone requires authentication (CVSS 8.7), but combining it with the Starlette host header validation bypass CVE-2026-48710 lets an attacker sidestep the authentication check entirely, yielding unauthenticated remote code execution assessed at CVSS 10.0 against any internet-exposed proxy.^[0]

CVE-2026-59822 (MCP Gateway auth bypass): the OAuth2 header handling returns an empty, unrestricted UserAPIKeyAuth() object when token validation fails rather than rejecting the request, so any Bearer token—even a single character such as 'x'—grants full MCP access; Wiz observed probing of model enumeration endpoints (GET /v1/models) using such tokens.^[53][60]

Default and missing authentication: Wiz found 9.6% of 3,074 internet-facing LiteLLM instances accepted the default master key sk-1234 or required no authentication, and that when no auth is configured LiteLLM grants all users PROXY_ADMIN access—turning post-auth issues such as the CVE-2026-59821 custom-code-guardrails root RCE and the pass-through-endpoint cloud credential theft vector into effectively pre-auth compromises.^[60]

Supply chain payload (CVE-2026-33634): the trojanized packages used a .pth Python startup hook that executes at interpreter initialization even without an explicit import, then ran a three-stage payload harvesting environment variables and local config files (.kube/config, .aws/credentials), attempting Kubernetes lateral movement, and installing a persistent systemd backdoor.^[0][40]

Affected versions and patch status

Indicators of Compromise

Key takeaways

• A centralized AI gateway that aggregates credentials from dozens of providers, executes server-side code, and connects to internal tools via MCP is a concentrated high-value target whose compromise yields every provider key at once and often the surrounding cloud environment.^[0][53][60]
• Security tooling with elevated CI/CD permissions is itself a high-value supply chain target: the poisoned Trivy scanner granted implicit downstream trust that let TeamPCP backdoor LiteLLM and harvest secrets from thousands of pipelines.^[0][40]
• Default and missing authentication dramatically amplify vulnerability severity: with 9.6% of public LiteLLM instances accepting sk-1234 or no auth, post-auth flaws such as CVE-2026-59821 become effectively pre-auth, underscoring that deployment hardening matters as much as patching.^[60]
• Rapid, sustained exploitation—confirmed within 36 hours of advisory indexing, two CISA KEV listings (CVE-2026-42271 and CVE-2026-59822), and ongoing honeypot activity—means AI gateway deployments must be explicitly included in threat models and patched with high priority.^[0][53][60]

Defensive actions

• Upgrade LiteLLM to v1.83.10-stable and update the underlying Starlette dependency.: This single upgrade closes CVE-2026-42208, CVE-2026-42271, and the CVE-2026-48710 host header bypass that enables the unauthenticated RCE chain.^[0]
• Remove the default master key (sk-1234) and enforce authentication on every LiteLLM deployment; verify no proxy grants unauthenticated PROXY_ADMIN access.: Wiz found 9.6% of public instances accepted the default key or required no auth, converting otherwise post-auth RCE and credential-theft vectors (CVE-2026-59821, MCP bypass, pass-through endpoint) into effectively pre-auth compromises.^[60]
• Block network access to the /mcp-rest/test/ endpoint path at an API gateway, reverse proxy, or perimeter firewall where an immediate upgrade is not possible.: Provides a partial compensating control for the RCE chain, though it does not address the SQL injection path.^[0]
• Rotate all credentials accessible to hosts that ran LiteLLM 1.82.7 or 1.82.8, including AI provider keys, cloud credentials, SSH private keys, and CI/CD tokens, and audit reachable Kubernetes service accounts.: The supply chain payload harvested these secrets and left minimal forensic trace; Hudson Rock's recovery of 118,829 CI runner dumps confirms mass exfiltration of live environment memory and configurations.^[0][40]
• Review PostgreSQL query logs for anomalous bearer token values in authentication queries on any proxy that ran versions 1.81.16 through 1.83.6 while reachable from an untrusted network.: This surfaces evidence of SQL injection exploitation of CVE-2026-42208.^[0]
• Never expose the LiteLLM proxy port directly to the internet; restrict it to authenticated internal clients and segment the host and its PostgreSQL instance from general corporate infrastructure.: Access-control hardening reduces exposure to the entire vulnerability class independent of any patch cycle and limits lateral movement from future compromises.^[0][60]
• Integrate dependency verification into pipelines, verify package hashes against known-good values, and treat security tooling running in CI/CD as potentially untrusted least-privilege input.: The supply chain attack succeeded because a poisoned security scanner running with elevated CI/CD permissions was granted legitimate read access to the runner and exfiltrated publishing tokens.^[0][40]

Changelog

• Added Wiz DEF CON 34 research findings: scanning of roughly 3,000 internet-facing LiteLLM deployments found 9.6% of 3,074 public instances accept the default master key (sk-1234) or require no authentication, making otherwise post-auth issues effectively pre-auth.^[60]
• Added newly disclosed vulnerabilities from Wiz research: post-auth root-level RCE via custom code guardrails (CVE-2026-59821), an unauthenticated admin-by-default behavior granting PROXY_ADMIN to all users, and a post-auth cloud credential theft vector via the pass-through endpoint's missing URL validation.^[60]
• Updated exploitation and remediation status for the MCP Gateway authentication bypass CVE-2026-59822: now confirmed added to CISA's Known Exploited Vulnerabilities catalog and observed exploited in the wild via Wiz honeypot infrastructure.^[60]