CVE-2026-59822

LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback

Published: Jul 8, 2026Updated: Sep 3, 2026 Sources: CVE List NVDCWE-287

8.2HIGH

Description

LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.84.0, LiteLLM's MCP Streamable HTTP endpoint allowed an unauthenticated attacker to use a fabricated Authorization header to trigger an OAuth2 passthrough fallback path that replaced failed LiteLLM key validation with an empty UserAPIKeyAuth() object, allowing requests to reach MCP tooling without a valid LiteLLM key. This issue is fixed in version 1.84.0.

In plain language

AI Act now

LiteLLM versions before 1.84.0 can be tricked by an internet attacker into skipping authentication for MCP tools, without any login—this is serious and you should update.

Executive summary

CVE-2026-59822 is an authentication bypass in LiteLLM’s MCP Streamable HTTP endpoint: a remote attacker can send a crafted Authorization header that triggers an OAuth2 passthrough fallback, substituting a missing/empty authentication object and allowing access to MCP tools without a valid LiteLLM key.

If affected, business impact

Unauthorized access to AI toolsMCP tool misuse or data leakageCompromise of backend servicesService disruption or abuse

What to do now

Check whether you run LiteLLM and its version is earlier than 1.84.0.
If you are earlier than 1.84.0, upgrade LiteLLM to 1.84.0.
If you cannot upgrade immediately, restrict network access so the MCP Streamable HTTP endpoint is not reachable from the internet, and contact your LiteLLM support/vendor for the recommended mitigation steps.

Patch / advisory Usually a quick update

What is it

Think of LiteLLM like a receptionist that checks an ID before letting people into your AI “tool room.” This flaw is like a trick that lets someone present a fake ID and still get the receptionist to hand them the keys anyway, so they can reach the MCP tools without a valid LiteLLM key.

If your LiteLLM service is reachable over the network, an attacker could use this to access tools they shouldn’t and potentially misuse them.

Who is affected

This matters if you run or host LiteLLM (an AI gateway/proxy) and you have MCP Streamable HTTP enabled in your setup. It’s a risk when your LiteLLM is reachable over the network (the findings say it is reachable in default configuration) because the attacker does not need a login or any user action.

In short: if LiteLLM is exposed to the internet, you should treat this as affecting you until you upgrade.

How urgent is it

This is RED because CISA added CVE-2026-59822 to its Known Exploited Vulnerabilities list (real-world active attention), meaning the risk is not theoretical. The attack is remote and does not require authentication or user interaction, so exposure is high if your LiteLLM is reachable.

Upgrade to the fixed version immediately and, if that’s not possible right away, cut off internet access to the affected endpoint while you plan the patch.

What to do — in detail

Confirm exposure and version
- Identify whether the business uses LiteLLM and determine the exact LiteLLM version.
- Verify whether the MCP Streamable HTTP endpoint is enabled in your LiteLLM deployment.
- Check whether the LiteLLM service is reachable from the internet (public IP, port forwarding, load balancer, or similar).
Determine if you’re affected
- You are affected if LiteLLM is prior to 1.84.0.
Upgrade remediation (primary fix)
- Upgrade LiteLLM to 1.84.0.
- Use your normal deployment process (container rebuild, package upgrade, or service redeploy) so the running service is actually updated.
- After upgrade, test MCP access using only legitimate LiteLLM credentials/keys to confirm expected authentication behavior.
If you cannot upgrade right away (temporary containment)
- Restrict network access so the MCP Streamable HTTP endpoint is not reachable from the internet.
- If you have a reverse proxy or firewall, lock it down to only trusted networks/IPs.
- Follow the vendor’s guidance referenced in the LiteLLM security advisory linked from the patch findings.
CISA due date and tracking
- CISA KEV remediation due date: 2026-09-16.
What to monitor
- Look for request logs on the MCP Streamable HTTP endpoint, especially requests with unusual or crafted Authorization headers.
- Monitor for unexpected MCP tool usage attempts that occur without corresponding valid LiteLLM key usage.

Technical context

Severity and risk posture: The reported issue is rated High (CVSS 8.2) and is classified as an authentication bypass.

CWE mapping: CWE-287 (Improper Authentication) and CWE-306 (Missing Authentication for Critical Function).

Mechanism: Before 1.84.0, an unauthenticated attacker can reach LiteLLM’s MCP Streamable HTTP endpoint remotely by sending a crafted Authorization header. This triggers an OAuth2 passthrough fallback path that replaces failed LiteLLM key validation with an empty authentication object (empty UserAPIKeyAuth()), allowing access to MCP tooling without a valid LiteLLM key.

Exploit status and KEV meaning: CVE-2026-59822 is listed in CISA KEV (added 2026-09-02), indicating confirmed real-world exploitation of the vulnerability class in the wild. That makes this urgent regardless of any public exploit availability.

Fixed version: LiteLLM is fixed in 1.84.0. No public exploit code was found in the provided findings.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

CVSS Vector Breakdown

Exploitability

AV:NAttack Vector

Network

AC:LAttack Complexity

Low

PR:NPrivileges Required

None

UI:NUser Interaction

None

Scope

S:UScope

Unchanged

Impact

C:HConfidentiality

High

I:LIntegrity

Low

A:NAvailability

None

Open in CVSS calculator →

Weaknesses

CWE-287 CWE-306

Affected Products

BerriAI

commercialaka berriai/litellm, litellm

litellmSaaS

AI / ML / llm-serving-inference

litellm

oss-project

litellmMixed

AI / ML / llm-serving-inference

Exploitability

CISA Known Exploited Vulnerability

Added to KEV:Sep 2, 2026

Remediation due:Sep 16, 2026

Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Official Patch Available

Workaround Available

Is your org exposed to CVE-2026-59822?Request an assessment to establish which checks are appropriate for your systems. Check my exposure