CVSS 10.0 RCE in Google ADK and the LiteLLM sk-1234 Scandal: AI Agent Infrastructure Is Under Attack

Introduction: 48 Hours That Exposed AI's Soft Underbelly

While the AI industry spent 2026 arguing about whether agents will replace apps, security researchers spent September 9 and 10 demonstrating something more urgent: the infrastructure everyone is building AI agents on top of is leaking from every seam.

Two disclosures landed almost simultaneously. First, CVE-2026-79696 — a CVSS 4.0 score of 10.0, the maximum possible — in Google Cloud's Agent Development Kit (ADK) for Python, allowing unauthenticated remote code execution against any internet-reachable deployment. Second, Wiz Research's viral findings on LiteLLM, the most popular open-source LLM gateway: 294 of 3,074 internet-facing instances (9.6%) still accept sk-1234 — the example master key printed in LiteLLM's own documentation — because the Docker and pip installers ship it as the default.

Neither story is about a frontier model misbehaving. Both are about the mundane plumbing — frameworks, gateways, proxy servers — that 2026's agent boom is being assembled with at breakneck speed. And both prove that attackers have noticed.

Google ADK: A Perfect 10.0 RCE

Published September 9, CVE-2026-79696 is a code injection vulnerability in adk web, the web UI component of Google Cloud's Agent Development Kit for Python. It affects versions 2.0.0 through 2.6.0 in Python (open-source), Cloud Run, and GKE environments — wherever the pytest package is installed, which, in a Python development tool, is nearly always.

The mechanics are almost embarrassing in their simplicity. The vulnerability class is CWE-184: Incomplete List of Disallowed Inputs. ADK's web component tries to block dangerous Python standard library calls, but the denylist was incomplete. An unauthenticated remote attacker can submit a crafted test session replay that smuggles code past the incomplete denylist, executing arbitrary code with the full privileges of the adk web process. The result is complete takeover of the environment where ADK runs — including any cloud credentials, API keys, and MCP tool connections that environment holds.

The fix shipped in ADK v2.6.1 and v2.7.0. Google is also patching cloud-hosted instances directly, but self-managed Cloud Run and GKE deployments need to upgrade manually. If you can't upgrade immediately, removing pytest where it isn't needed closes the exploit precondition.

The bitter irony: the attack enters through a test session replay feature. The very tooling developers use to validate their agents became the tunnel attackers use to own them.

The LiteLLM sk-1234 Scandal

If the Google flaw is a sharp, single vulnerability, the LiteLLM story is a systemic facepalm. Wiz Research scanned roughly 3,000 internet-facing LiteLLM deployments — the open-source gateway that sits between applications and LLM APIs, managing keys, routing, and budgets — and published the full research (originally presented at DEF CON 34) this week.

The headline finding: 9.6% of exposed instances accepted the default master key sk-1234 or required no authentication at all. As of September 9, LiteLLM's own setup documentation still used sk-1234 as the example — above a comment telling operators to replace it, a comment that nearly one in ten apparently never read. Worse, the master key isn't just an admin credential: it also serves as the HS256 secret for signing session JWTs. Leave the default in place, and anyone on the internet can forge admin sessions for your entire gateway.

The report bundles four CVEs, several of which chain together into full compromise:

The MCP auth bypass deserves special attention because of how it fails. When a Bearer token fails LiteLLM key validation, the handler's OAuth2 passthrough fallback doesn't distinguish "legitimate token for an upstream provider" from "complete garbage" — it catches the 401 and returns an empty auth object, granting access as if the request were authenticated. An attacker needs exactly one request with Authorization: Bearer a to establish a fully authenticated MCP session.

This isn't theoretical. CISA added CVE-2026-59822 to its Known Exploited Vulnerabilities catalog on September 2, giving federal civilian agencies until September 16 to remediate. Wiz has observed active exploitation in its own honeypot infrastructure since July — single-character tokens probing model listing endpoints. And on any gateway still running sk-1234 with a pre-1.82.0 version, the RCE chain is effectively pre-auth: one request with a default key yields root access to the container and everything it can reach.

What does an owned gateway expose? Every provider API key it routes to, every prompt and reply passing through it, and every internal tool connected via MCP. Wiz also documented cloud credential theft via pass-through endpoints that lack URL validation — a design choice Wiz says LiteLLM doesn't even consider a vulnerability.

Why AI Infrastructure Keeps Getting Owned

Put these two disclosures next to the year's earlier agent security stories — the Miasma worm hitting AI coding agents through the supply chain, the 3,700 hijacked OpenAI agents in the DSEWiki incident, GitSpawn's rogue .git configs — and a pattern emerges that has nothing to do with model intelligence:

• Speed of adoption outpaces security review. LiteLLM and Google ADK both went from niche projects to core enterprise infrastructure in under two years. Nobody audited the defaults at that pace — 85,000+ LiteLLM instances were visible in an August 2026 follow-up scan.
• The gateway is the crown jewels. An LLM gateway aggregates every key, every conversation, and every tool connection in one place. In the pre-AI era we learned to obsess over database exposure; the LLM gateway is the new database, and 1 in 10 are wide open.
• MCP expands the blast radius. Model Context Protocol connects gateways to internal tools, data stores, and SaaS. An MCP auth bypass isn't just "read some models" — it's a foothold into whatever the agent can touch.
• Denylists don't work. Google's CVSS 10.0 came from an incomplete blocklist of standard library calls — the same class of mistake (CWE-184) that has burned interpreters, sandboxes, and WAFs for decades. AI frameworks are relearning it at scale.

The uncomfortable takeaway for anyone building with agents in 2026: your risk surface is no longer the model — it's the stack around it. If you're evaluating agent frameworks or gateways, security posture needs to be a first-class selection criterion, right alongside capability. The ecosystems around tools like LangChain and the model hubs on Hugging Face power incredible velocity, but every dependency you add is another surface like these.

How to Lock Down Your AI Stack Right Now

Whether you run Google ADK, LiteLLM, or any agent framework, this week's news translates into a concrete checklist:

• Upgrade Google ADK to v2.6.1+ (or v2.7.0) if you run adk web anywhere reachable — and remove pytest from production images to kill the exploit precondition.
• Rotate any LiteLLM master key that isn't a long random string. Check whether a separate salt key is set first — the rotation procedure differs, and the wrong one can leave stored credentials unreadable.
• Upgrade LiteLLM to 1.84.0 or later, which sits above the fixed version of every CVE in the table.
• Never expose the gateway to the public internet. Put it behind a VPN or private network; if you can't, block /mcp/, the MCP test endpoints, and POST /guardrails/test_custom_code at your reverse proxy today.
• Audit MCP tool connections. Every connected server is reachable by anyone who can bypass gateway auth — enumerate them and apply least privilege to each.
• Restrict container egress and IAM. Both the ADK RCE and LiteLLM's pass-through credential theft are only as bad as what the compromised environment can reach. Least-privilege IAM (like IRSA on Kubernetes) turns full takeover into a contained incident.
• Watch for the honeypot signature: requests to MCP endpoints with single-character or malformed Bearer tokens probing tools/list and model listing endpoints.

None of this requires abandoning agents. It requires treating AI infrastructure like the production-critical systems they've become — with defaults audited, versions current, and network exposure minimized. The teams that do this will keep shipping; the 9.6% that don't are one single-character token away from a very bad week.

Frequently Asked Questions