Off Guard: Breaking LiteLLM from authentication bypass to cloud compromise

This report documents multiple critical vulnerabilities in LiteLLM—including an MCP auth bypass allowing authenticated MCP sessions with arbitrary Bearer tokens, a custom-code guardrail path enabling remote code execution, widespread default or missing master keys (notably `sk-1234`) exposing many public instances, and pass-through endpoints that can exfiltrate cloud metadata credentials—resulting in root/container compromise, credential theft, and LLMjacking; fixes and CVEs have been released but exploitation was observed in the wild.