LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback
LiteLLM releases before 1.84.0 with the MCP Streamable HTTP endpoint exposed let unauthenticated callers reach configured MCP tools and connected services. The fix is in 1.84.0.
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Actively exploited
- Fix
- Fixed in 1.84.0
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
LiteLLM, a proxy server that gives applications a unified OpenAI-style interface to LLM APIs, is affected through its MCP Streamable HTTP endpoint. An unauthenticated attacker could bypass LiteLLM's key checks and reach MCP tools without a valid LiteLLM key, potentially gaining access to those tools and the resources behind them.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.84.0, LiteLLM's MCP Streamable HTTP endpoint allowed an unauthenticated attacker to use a fabricated Authorization header to trigger an OAuth2 passthrough fallback path that replaced failed LiteLLM key validation with an empty UserAPIKeyAuth() object, allowing requests to reach MCP tooling without a valid LiteLLM key. This issue is fixed in version 1.84.0.
Timeline
- CVE published
- Added to CISA KEV
CISA has evidence of exploitation in the wild
- Record last updated
- CISA remediation deadline
Due date for US federal agencies to patch
Affected versions
- BerriAI litellm
fixed in 1.84.0
- litellmPyPI
fixed in 1.84.0
- litellmPyPI
fixed in 1.84.0
References 4
GitHub · BerriAI/litellm
Questions about CVE-2026-59822
What does this mean?
An unauthenticated attacker could establish an authenticated MCP session, list and call configured MCP tools, and access connected services exposed through MCP.Source: github.com
Am I affected, and how do I check?
LiteLLM releases before 1.84.0 are affected, but only where the MCP Streamable HTTP endpoint is exposed. Check the installed LiteLLM version and whether MCP endpoints such as /mcp/ are reachable from outside the network.Source: github.com
What should I do about it?
Upgrade LiteLLM to 1.84.0 or later, which contains the fix.Source: github.com
Is it being exploited?
Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2026-09-02, which means it has evidence of attacks. No public exploit code is tracked.Source: cisa.gov, cve.now feed data