Wiz discloses LiteLLM authentication bypass and RCE vulnerabilities; nearly one in ten public instances use default keys

Wiz Research scanned about 3,000 public LiteLLM instances and found that 9.6% (294) accepted the default master key sk-1234 or required no authentication at all, of which 191 (6.2%) had no authentication. Using Claude Code to review the LiteLLM code, the research found an MCP endpoint authentication bypass (CVE-2026-59822): after any arbitrary Bearer token fails validation, an empty authentication object is returned, allowing a single request to establish an authenticated MCP session and then call connected tools; and a post-authentication root-level remote code execution in custom code guardrails (CVE-2026-59821), where the registration endpoint neither checks disabled mode nor clears __builtins__, and code executes at guardrail registration time.