Vulnerability record · CVE-2026-59822 · published 8 July 2026
CVE-2026-59822: LiteLLM MCP endpoint auth bypass via OAuth2 passthrough fallback
Litellm · Litellm
LiteLLM's MCP Streamable HTTP endpoint, prior to 1.84.0, let an unauthenticated attacker send a fabricated Authorization header that triggered an OAuth2 passthrough fallback path. That path replaced failed LiteLLM key validation with an empty UserAPIKeyAuth() object, so requests reached MCP tooling without a valid LiteLLM key. This is an authentication bypass on an AI gateway that fronts LLM APIs and tooling.
Description
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.84.0, LiteLLM's MCP Streamable HTTP endpoint allowed an unauthenticated attacker to use a fabricated Authorization header to trigger an OAuth2 passthrough fallback path that replaced failed LiteLLM key validation with an empty UserAPIKeyAuth() object, allowing requests to reach MCP tooling without a valid LiteLLM key. This issue is fixed in version 1.84.0.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:
Automated analysis
critical priorityIt is an unauthenticated network-reachable authentication bypass on an AI gateway and is listed in CISA KEV as exploited.
What it is
LiteLLM's MCP Streamable HTTP endpoint, prior to 1.84.0, let an unauthenticated attacker send a fabricated Authorization header that triggered an OAuth2 passthrough fallback path. That path replaced failed LiteLLM key validation with an empty UserAPIKeyAuth() object, so requests reached MCP tooling without a valid LiteLLM key. This is an authentication bypass on an AI gateway that fronts LLM APIs and tooling.
Impact
An attacker gains unauthenticated access to MCP tooling behind the gateway, with high confidentiality impact and limited integrity impact per the CVSS vector. No availability impact is recorded.
Attack surface
Reachable over the network via the MCP Streamable HTTP endpoint; the CVSS vector shows no privileges required and no user interaction. Only a crafted Authorization header is needed.
Exploitation
CISA added it to KEV with a 2026-09-16 due date, indicating known exploitation, while EPSS is low at 0.0087 (57th percentile). No ransomware campaign use is documented.
What to do
- Upgrade LiteLLM to 1.84.0 or later, which contains the fix.
- If immediate upgrade is not possible, restrict network access to the MCP Streamable HTTP endpoint to trusted clients only.
- Disable or block the OAuth2 passthrough fallback path until patched, per vendor advisory GHSA-7488-6r32-c95q.
- Follow CISA BOD 26-04 guidance, including evaluating internet exposure and discontinuing use if mitigations are unavailable.
Detection
- Hunt proxy and application logs for requests to the MCP Streamable HTTP endpoint carrying Authorization headers that fail LiteLLM key validation but still return success.
- Alert on authentication events where an empty or anonymous UserAPIKeyAuth object is created.
- Monitor for MCP tool invocations from clients with no associated valid LiteLLM key.
- Review internet-facing LiteLLM instances for exposure of the MCP endpoint.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2026-59822 to the Known Exploited Vulnerabilities catalog on 2 September 2026 as "BerriAI LiteLLM Improper Authentication Vulnerability". Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal deadline 16 September 2026.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://github.com/BerriAI/litellm/commit/73869f0faf7d11ee21adcb5f91b8c33a340b6c2c | Patch |
| https://github.com/BerriAI/litellm/pull/26463 | Issue TrackingPatch |
| https://github.com/BerriAI/litellm/releases/tag/v1.84.0 | ProductRelease Notes |
| https://github.com/BerriAI/litellm/security/advisories/GHSA-7488-6r32-c95q | MitigationPatchVendor Advisory |
| https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-59822 | US Government Resource |
| https://www.wiz.io/blog/ai-infrastructure-honeypot | Third Party Advisory |
Track CVE-2026-59822 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2026-59822), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
