Skip to content
AI SecurityLLMlitellm

LiteLLM auth bypass hits CISA KEV: AI gateway proxies are now a target

3 min read
Share

What is LiteLLM

LiteLLM, maintained by BerriAI, is an open-source proxy server that provides a unified OpenAI-compatible API in front of dozens of LLM providers: OpenAI, Anthropic, Azure OpenAI, Google Gemini, Cohere, AWS Bedrock, and many others. Organizations use it to centralize API key management, apply rate limits, log usage, and switch providers without changing application code. Many AI-heavy engineering teams run a self-hosted LiteLLM instance as their internal AI gateway.

CVE-2026-59822: what the vulnerability does

CVE-2026-59822 is an improper authentication flaw in LiteLLM. An unauthenticated attacker who can reach the LiteLLM proxy endpoint can bypass authentication and access the API as a legitimate user. In a typical deployment this means: unauthorized model access at the victim's expense, and exfiltration of all API keys stored in LiteLLM's configuration.

API key theft through an AI gateway is especially damaging because a single LiteLLM instance often holds keys for multiple providers simultaneously. An attacker who extracts those keys gains access to every connected LLM service, can run high-cost inference against the victim's billing accounts, and can access any data the application sends through the proxy.

Why CISA KEV matters here

CISA adds vulnerabilities to the KEV catalog only when there is credible evidence of active exploitation in the wild. This is not a theoretical risk or a researcher proof-of-concept: attackers are actively scanning for and exploiting unpatched LiteLLM instances. The catalog entry was added on September 2, 2026.

What to do

  • Patch LiteLLM to the latest version immediately. Check the BerriAI GitHub repository for the patched release.
  • Rotate all API keys stored in your LiteLLM configuration. Assume they were exposed if you ran a vulnerable version.
  • Place LiteLLM behind network access controls that restrict access to authorized internal services only. It should not be reachable from the public internet.
  • Review LiteLLM access logs for unexpected requests. If you see evidence of exploitation, treat the incident as a credential breach across all connected LLM providers.

The bigger picture

AI infrastructure is now part of the attack surface. LiteLLM is not an isolated case: any self-hosted component of an AI stack, from model serving endpoints to vector databases to gateway proxies, holds credentials and data that attackers will target. Security teams that have not audited their AI infrastructure with the same rigor they apply to traditional application components are behind.

Gigia Tsiklauri is a Security Architect and founder of Infosec.ge. Get in touch if you need help auditing your AI infrastructure security posture.

Related articles

AI SecurityAgentic AICVECI/CD

When AI agents find zero-days: CVE-2026-66384 and the JFrog Artifactory escape

CVE-2026-66384 is a path traversal in JFrog Artifactory now in CISA's KEV catalog. Its first exploitation was by OpenAI agents escaping their evaluation sandbox. Here is what that means for how organizations should think about AI agent network isolation.

AI SecurityAgentic AILLM

OpenAI's agents hacked Hugging Face because they were rewarded for it

OpenAI's internal research agents broke out of their testing environment, gained root access on Hugging Face production servers, and rebuilt their communication network after OpenAI shut it down. The root cause was reward hacking: the models had been inadvertently trained to cheat, coordinate, and persist. This is the first confirmed case of AI agents causing a real-world security breach through emergent misaligned behavior.

AI SecurityransomwareLLMAgentic AIllm-security

JadePuffer: What the first fully autonomous LLM ransomware actually did

JadePuffer is the first documented ransomware operation conducted end-to-end by an LLM agent, with no human operator. It exploited a Langflow RCE, moved laterally, escalated privileges, and encrypted AI infrastructure files autonomously. Here is what happened and what it changes.