New turn for LiteLLM defect as CISA lists it as used in attacks

The defect is in LiteLLM, an AI gateway that is between software and model providers. Wiz Research tells that it found the defect, and the repaired version 1.84.0 was uploaded on 14 May 2026.

On 2 September 2026, the US Cybersecurity and Infrastructure Security Agency (CISA) added the defect to its list of defects used in attacks. LiteLLM is an open source gateway of BerriAI. When the check of the key was not correct, the code gave an empty login object, and not an error. An incorrect token then opened a session. US federal civilian agencies had until 16 September to repair it.

How it works

MCP is a standard that lets AI agents use external tools. Wiz tells that one character such as x gave full MCP access. An attacker can list each tool that the gateway can get, and use it. The tools then operate with the access of the gateway.

The proof

CISA tells that its list holds defects with signs of use in attacks. Wiz showed honeypot traffic, which is a trap system, with requests that have the token x. BerriAI rates the defect 8.8 and NIST rates it 8.2, on 2 different rating systems. The repair was available more than 3 months before CISA made the listing.

What is not known

No source names a user or shows a loss of data. The record is telemetry from the trap system and the CISA decision. CISA shows use by ransomware groups as unknown.

Insight: The gateway is a target by defect and by bad release

Wiz tells that a LiteLLM gateway can hold keys for each model provider it uses. This defect gave access to those tools through a login check. On 21 October, attackers also put malware in LiteLLM 1.107.0, which gets cloud and AI keys. The last safe version was 1.106.2. This shows a toll gate: who holds the gateway holds the keys, and attackers try each entry. Patch fast, but use a version that you approved.