CISA adds an authentication bypass in the LiteLLM AI gateway to its exploited-vulnerabilities catalog
CVE-2026-59822 lets an unauthenticated attacker send a fabricated Authorization header to LiteLLM's MCP Streamable HTTP endpoint, triggering an OAuth2 passthrough fallback that replaces failed key validation with an empty authorisation object and admits requests to MCP tooling. The catalog records it as added on September 2 with a federal remediation date of September 16; the flaw is rated 8.8 under CVSS 4.0 and 8.2 under CVSS 3.1 and is fixed in LiteLLM 1.84.0.
Wiz honeypots record attackers exploiting MCP servers and self-hosted AI stacks
Over a 90-day honeypot study across self-hosted AI services, Wiz Threat Research observed three attack patterns against AI infrastructure: exploitation of Model Context Protocol servers, including an authentication bypass in LiteLLM's MCP gateway that accepted any bearer token and a command-injection flaw used to drop cryptominers; blind indirect prompt injection against LangChain, Flowise, OpenWebUI and Node-RED deployments, confirmed through out-of-band DNS callbacks; and AI-native post-exploitation in which attackers read a compromised LiteLLM process's Python module state in memory to steal master keys rather than searching files.
Microsoft reports attackers compromising self-hosted AI gateways and orchestration platforms for credentials and cryptomining
Microsoft Threat Intelligence describes investigations into intrusions against three self-hosted AI workloads — a LiteLLM gateway, a RAGFlow deployment and a Kestra environment — each reached through vulnerabilities the post names. In the RAGFlow case the attackers injected Python hooks into credential-configuration workflows to intercept newly configured model-provider credentials; across the cases they harvested environment variables and database credentials, established persistence through SSH keys and cron jobs, and deployed the XMRig cryptominer.