Detect BerriAI LiteLLM Improper Authentication (CVE-2026-59822) in Sumo Logic CSE
Detects exploitation of CVE-2026-59822, a KEV-listed improper authentication / missing authentication vulnerability (CWE-287, CWE-306) in BerriAI LiteLLM. Affected deployments allow unauthenticated or improperly authenticated access to the LiteLLM proxy/admin API, enabling attackers to reach privileged endpoints (model management, key generation, config, and completion routing) without valid credentials. Detection focuses on anomalous access to LiteLLM proxy endpoints — successful requests to sensitive paths lacking Authorization/master-key headers, key-generation and admin actions from unexpected sources, and access patterns to /key/generate, /user/new, /model/new, /config/update and completion endpoints without prior authentication.
MITRE ATT&CK
Sumo Detection Query
_sourceCategory=*proxy* OR _sourceCategory=*litellm*
| parse regex "(?<method>\w+)\s+(?<uri>\S+)\s+HTTP" nodrop
| parse regex "(?i)(?<auth>authorization|bearer|x-litellm-api-key)" nodrop
| where uri matches /.*(\/key\/generate|\/user\/new|\/model\/new|\/config\/update|\/team\/new|\/chat\/completions).*/
| where isBlank(auth)
| count by src_ip, uri
| where _count > 0
| sort by _count descSumo Logic query detecting unauthenticated access to LiteLLM sensitive endpoints, matching the improper authentication behavior of CVE-2026-59822.
Data Sources
Required Tables
False Positives & Tuning
- Synthetic monitoring requests
- Auth headers stripped upstream before collection
- Admin master-key bootstrap
Other platforms for CVE-2026-59822
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Unauthenticated key generation request against LiteLLM proxy
Expected signal: Proxy/access log entry for POST /key/generate on port 4000 with no Authorization header.
- Test 2Unauthenticated model configuration change
Expected signal: Access log entry for POST /model/new without Authorization header.
- Test 3Unauthenticated completion routing via exposed proxy
Expected signal: Proxy log entry for POST /chat/completions with no Authorization header from the test host.
References (4)
- https://github.com/BerriAI/litellm/security/advisories/GHSA-7488-6r32-c95q
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- https://nvd.nist.gov/vuln/detail/CVE-2026-59822
Response Playbook
Triage
- Confirm the target host is running BerriAI LiteLLM proxy and identify its version against GHSA-7488-6r32-c95q to determine if it is within the affected/unpatched range.
- Review the flagged requests: determine whether the source IP is internal/trusted or external, and whether the sensitive endpoint (e.g. /key/generate, /model/new, /config/update) returned a 2xx status without an Authorization or master-key header.
- Correlate the source IP's full request timeline to distinguish a single probe from a sustained exploitation sequence (enumeration followed by key generation and model routing changes).
- Check LiteLLM proxy logs and any created virtual keys or users to establish whether unauthorized credentials were minted during the window.
Containment
- Restrict network access to the LiteLLM proxy management/API ports (default 4000) to trusted management networks only, via firewall or security group rules.
- Upgrade LiteLLM to the fixed version per GHSA-7488-6r32-c95q and ensure a strong LITELLM_MASTER_KEY / proxy auth is enforced on all admin endpoints.
- Revoke and rotate any virtual keys, master keys, or user credentials that may have been generated or exposed during the exploitation window.
Evidence Collection
- Preserve LiteLLM proxy access and application logs, and upstream reverse-proxy/WAF logs covering the suspicious source IP and time window.
- Export the list of virtual keys, users, teams, and model configurations with their creation timestamps to identify attacker-created artifacts.
- Capture the LiteLLM configuration (config.yaml/DB) and environment to document whether master-key enforcement was present at time of exploitation.
Escalation Criteria
- !Escalate to incident response if unauthorized virtual keys, users, or model/config changes were created from an untrusted source.
- !Escalate if the exploited proxy has access to backend LLM provider credentials or downstream systems, indicating potential lateral movement or credential theft.
- !Escalate if exploitation originated from an external/internet-facing address, confirming exposure of an unpatched KEV-listed vulnerability.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
LiteLLM proxy access logs showing requests to admin endpoints without Authorization headers - >
LiteLLM database/config records of newly created virtual keys, users, and teams with anomalous timestamps - >
Reverse proxy / WAF logs recording the source IP and request headers for the exploitation window
Tuning Guidance
Baseline the set of source IPs that legitimately administer the LiteLLM proxy (CI/CD runners, admin jump hosts) and exclude them from alerting. Confirm your log pipeline reliably captures request headers so the absence of Authorization is meaningful rather than a parsing gap — where headers are not logged, pivot to status-code and endpoint-based logic. Scope port filters to the actual LiteLLM listener ports in your environment and exclude health/readiness probe paths to reduce noise.
Hunting Queries
Hunts for unauthenticated access to LiteLLM administrative endpoints across proxy telemetry to surface exploitation attempts of CVE-2026-59822.
CommonSecurityLog | where RequestURL has_any ("/key/generate", "/model/new", "/config/update") | where AdditionalExtensions !has "Authorization" | summarize count() by SourceIP, RequestURL, bin(TimeGenerated, 1h)index=proxy (uri="*/key/generate*" OR uri="*/model/new*" OR uri="*/config/update*") | eval has_auth=if(match(_raw,"(?i)authorization"),1,0) | where has_auth=0 | stats count by src_ip, uriAtomic Red Team Tests
Simulates an attacker attempting to generate a virtual key on the LiteLLM proxy without providing a master key/Authorization header.
Command
curl -s -o /dev/null -w '%{http_code}' -X POST http://localhost:4000/key/generate -H 'Content-Type: application/json' -d '{"models":["gpt-4"]}'Cleanup
curl -s -X POST http://localhost:4000/key/delete -H 'Content-Type: application/json' -d '{"keys":["sk-generated-test-key"]}' || trueExpected Telemetry
Proxy/access log entry for POST /key/generate on port 4000 with no Authorization header.
Expected Detection
Detection fires on unauthenticated request to /key/generate sensitive endpoint.
Attempts to add a new model to the LiteLLM proxy configuration without authentication to test admin endpoint exposure.
Command
curl -s -o /dev/null -w '%{http_code}' -X POST http://localhost:4000/model/new -H 'Content-Type: application/json' -d '{"model_name":"rogue","litellm_params":{"model":"gpt-4"}}'Cleanup
curl -s -X POST http://localhost:4000/model/delete -H 'Content-Type: application/json' -d '{"model_name":"rogue"}' || trueExpected Telemetry
Access log entry for POST /model/new without Authorization header.
Expected Detection
Detection fires on unauthenticated access to /model/new admin endpoint.
Sends a chat completion request through the LiteLLM proxy without an API key to verify unauthenticated inference access.
Command
powershell -Command "try { Invoke-WebRequest -Uri 'http://localhost:4000/chat/completions' -Method POST -ContentType 'application/json' -Body '{\"model\":\"gpt-4\",\"messages\":[{\"role\":\"user\",\"content\":\"test\"}]}' -UseBasicParsing } catch { $_.Exception.Response.StatusCode.value__ }"Cleanup
echo 'No cleanup required'Expected Telemetry
Proxy log entry for POST /chat/completions with no Authorization header from the test host.
Expected Detection
Detection fires on unauthenticated completion request to the exposed proxy.