AI Gateways on the Public Internet: 35,130 Indexed LiteLLM Endpoints and the Credentials Behind Them

An LLM gateway is a credential aggregation point. It holds provider keys, issues virtual keys to internal teams, and increasingly proxies Model Context Protocol tools that reach databases and internal APIs. When one of these gateways is reachable from the internet, the exposure is not equivalent to a typical web application.

The vulnerability context

CVE-2026-59822 affects BerriAI LiteLLM. The MCP Streamable HTTP endpoint could accept a crafted bearer token and fall through to an OAuth2 passthrough path, returning an empty authentication object instead of rejecting the request. An unauthenticated caller could then enumerate and invoke MCP tools exposed through the gateway. CISA added the vulnerability to the Known Exploited Vulnerabilities catalog on 2 September 2026, and Wiz Research described a broader chain reaching cloud credentials.

What the measurement shows

A ZoomEye query for the LiteLLM application fingerprint returns 35,130 indexed instances. This figure measures internet-visible deployments identified by the product fingerprint. It is not a count of vulnerable instances, and it does not distinguish between a gateway serving a single internal team and one aggregating credentials for an entire organization.

The number is notable for what it says about deployment practice. LiteLLM is frequently deployed by platform or data teams to simplify model access, and the deployment is often treated as an internal service. A count in the tens of thousands of internet-visible instances suggests that a meaningful share of deployments are reachable from outside the network they were intended to serve.

Why the exposure matters more than the count

The severity of a gateway compromise is set by what the gateway can reach. A LiteLLM deployment typically holds:

• Provider API keys for every model vendor configured behind it.
• Virtual keys issued to internal applications and teams.
• Configuration describing upstream endpoints and routing rules.
• MCP tool registrations that may reach databases, repositories or cloud APIs.

An attacker who reaches the gateway inherits that set of permissions. Reported activity against AI infrastructure has included reading configuration to recover credentials and using the gateway as a pivot toward downstream services. The gateway is valuable not because of what it stores, but because of what it is trusted to do.

A verification checklist

For organizations running a gateway, the measurement suggests a short list of checks.

1. Determine whether the gateway is reachable from the internet. If it is, that is the first thing to change, independent of patch status.
2. Confirm the deployed version against the vendor advisory and patch the MCP authentication path.
3. Test the MCP endpoint with an invalid token and confirm the response is a rejection rather than a successful tool listing.
4. Review the registered tool set and remove tools that are not required.
5. Rotate provider keys and virtual keys that the gateway could read.
6. Review outbound connections from the gateway host for destinations the organization does not recognize.

Where ZoomEye fits

The measurement answers a question that internal inventories often miss: how many systems that look like this are visible from the outside? For an organization that deployed a gateway for internal use, an external measurement is a direct check on whether that intent held.

The same capability supports tracking. Repeating the query over time shows whether the exposed population is growing or shrinking, which is a useful signal about whether gateway deployments are being hardened or simply accumulating.

References

• LiteLLM, GitHub Security Advisory GHSA-7488-6r32-c95q (CVE-2026-59822).
• Wiz Research, "Off Guard: Breaking LiteLLM from Authentication Bypass to Cloud Compromise," 9 September 2026.
• CISA, Known Exploited Vulnerabilities Catalog, 2 September 2026 update.
• ZoomEye measurement of the LiteLLM application fingerprint, collected 20 September 2026.

Limitations

The exposure figure is a ZoomEye index count collected on 20 September 2026 using the app="LiteLLM" fingerprint. It measures internet-visible, fingerprinted instances and does not indicate version, patch state, configuration, or whether a deployment holds production credentials. Fingerprint matching identifies the product rather than the version, so affected-version filtering was not possible from this query. Index counts change over time.