A One-Character Token Was Enough: LiteLLM and the Credential Concentration Problem in AI Gateways

In one honeypot capture, the request that started an intrusion looked like this: a GET to the models endpoint with an Authorization header containing the single character x. It worked. That detail is the clearest possible illustration of what went wrong in LiteLLM, and of why AI gateways have become a category of infrastructure that deserves the same scrutiny as an identity provider.

The flaw

CVE-2026-59822 is an improper authentication vulnerability in LiteLLM's MCP Streamable HTTP endpoint. The root cause is in the OAuth2 header handling path: when a token fails validation, the code returns an empty authentication object rather than rejecting the request. An object with no restrictions satisfies the check. Any bearer token, including a single character, passes.

The practical effect is that an unauthenticated attacker can list and invoke MCP tools. Those tools are not decorative. They are the mechanism by which an AI gateway reaches downstream systems.

Why a gateway is the wrong place for a weak check

LiteLLM is a proxy that fronts many model providers. Organisations deploy it so that applications can call multiple models through one interface, with centralised key management, cost tracking and access control. That design concentrates value:

• Provider API keys for every integrated model vendor.
• Virtual keys issued to applications and teams.
• Upstream endpoint configuration.
• In many deployments, database access and cloud credentials.

Research published by Wiz described attackers reading the running Python process memory to recover the LiteLLM proxy master key, which bypasses key files and configuration paths entirely. They also described direct queries against the LiteLLM database tables that hold model configuration and key material.

The chain, not the single bug

CVE-2026-59822 was not exploited alone. Two related issues complete the picture. CVE-2026-42271 is a command injection in the MCP stdio test endpoint: an attacker submits a forged MCP server configuration whose command field launches a Python downloader and a miner, while the test still returns a normal-looking handshake. CVE-2026-48710 is a host header bypass in Starlette, the underlying ASGI framework, which allows path injection that defeats authentication checks depending on the reconstructed URL.

Chained, these produce fully unauthenticated remote code execution. Reporting associated the chain with the Qilin ransomware group.

What was observed in the wild

Wiz ran honeypots impersonating LiteLLM, MCP servers, LangChain, Flowise, Langflow, OpenWebUI and Node-RED over roughly 90 days. Microsoft published independent findings over the same period. The observed behaviours are worth listing because they are specific:

• Miners hidden in AI-adjacent directories. A miner was placed in a hidden .claude directory and renamed unicorn, blending into an AI development environment.
• Persistence through ordinary mechanisms. Modified SSH keys, altered cron entries, services renamed to look legitimate, immutable file attributes and restart-surviving hooks.
• Configuration-path implants. In RAGFlow, a hidden Python hook in the LLM provider configuration path silently captured API keys, model names, provider types and endpoints each time an administrator saved settings.
• Workflow execution as the payload. In Kestra, an authentication bypass was used to run shell commands through a workflow and mine Monero.

Remediation

1. Upgrade LiteLLM to a fixed release. The advisory identifies 1.84.0 as the fixed version for CVE-2026-59822.
2. Inventory AI infrastructure that nobody registered. The recurring theme in the reporting is that gateways and MCP servers were stood up by application teams and never entered a security asset register.
3. Do not expose MCP or administrative endpoints to the internet. Restrict them to the networks that need them.
4. Disable test routes that are not in use. The command injection lived in a test endpoint.
5. Move secrets out of environment variables and configuration files. Reading process memory defeats file-based protection. Managed secrets with short-lived credentials change the outcome.
6. Check for the specific artifacts. Look for unexpected entries in ~/.ssh/authorized_keys, hidden directories in AI project paths, and processes named after common system daemons that hold real memory.

The structural lesson

The reason CVE-2026-59822 matters is not that a check was written incorrectly. It is that a single component had accumulated access to every model provider, every application key, the database and, in many deployments, the cloud environment. When a component aggregates that much authority, its authentication logic stops being an implementation detail and becomes a control boundary.

The MCP test endpoint illustrates a related point. A feature whose purpose is to verify that a configuration works must execute the command in that configuration. That is the design. It also means the endpoint is, by construction, an execution surface, and it should be treated as one rather than as a diagnostic convenience.

References

• Wiz Research: breaking LiteLLM from authentication bypass to cloud compromise, September 2026
• Microsoft security research on AI infrastructure targeting, September 2026
• NVD entries for CVE-2026-59822, CVE-2026-42271 and CVE-2026-48710
• CISA Known Exploited Vulnerabilities Catalog, LiteLLM entry added 2 September 2026
• GitHub security advisories for the LiteLLM and Starlette issues