CVE-2026-59822

LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback

Exploited in the wild. In CISA KEV since 2026‑09‑02. A vendor fix is available.

CVSS 3.18.2High EPSS percentile56th0.8% chance in 30 days CISA KEVListedsince 2026-09-02, due 2026-09-16
No public exploit known FixVendor fixNo build named by the sources

Published 2026-07-08Updated 2026-09-03Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check whether you run LiteLLM and its version is earlier than 1.84.0.
If you are earlier than 1.84.0, upgrade LiteLLM to 1.84.0.
If you cannot upgrade immediately, restrict network access so the MCP Streamable HTTP endpoint is not reachable from the internet, and contact your LiteLLM support/vendor for the recommended mitigation steps.

Vendor advisory Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.84.0, LiteLLM's MCP Streamable HTTP endpoint allowed an unauthenticated attacker to use a fabricated Authorization header to trigger an OAuth2 passthrough fallback path that replaced failed LiteLLM key validation with an empty UserAPIKeyAuth() object, allowing requests to reach MCP tooling without a valid LiteLLM key. This issue is fixed in version 1.84.0.

In plain language

Written by AI from the record

LiteLLM versions before 1.84.0 can be tricked by an internet attacker into skipping authentication for MCP tools, without any login—this is serious and you should update.

CVE-2026-59822 is an authentication bypass in LiteLLM’s MCP Streamable HTTP endpoint: a remote attacker can send a crafted Authorization header that triggers an OAuth2 passthrough fallback, substituting a missing/empty authentication object and allowing access to MCP tools without a valid LiteLLM key.

If you're affected

Unauthorized access to AI tools
MCP tool misuse or data leakage
Compromise of backend services
Service disruption or abuse

What is it

Think of LiteLLM like a receptionist that checks an ID before letting people into your AI “tool room.” This flaw is like a trick that lets someone present a fake ID and still get the receptionist to hand them the keys anyway, so they can reach the MCP tools without a valid LiteLLM key.

If your LiteLLM service is reachable over the network, an attacker could use this to access tools they shouldn’t and potentially misuse them.

Who is affected

This matters if you run or host LiteLLM (an AI gateway/proxy) and you have MCP Streamable HTTP enabled in your setup. It’s a risk when your LiteLLM is reachable over the network (the findings say it is reachable in default configuration) because the attacker does not need a login or any user action.

In short: if LiteLLM is exposed to the internet, you should treat this as affecting you until you upgrade.

How urgent is it

This is RED because CISA added CVE-2026-59822 to its Known Exploited Vulnerabilities list (real-world active attention), meaning the risk is not theoretical. The attack is remote and does not require authentication or user interaction, so exposure is high if your LiteLLM is reachable.

Upgrade to the fixed version immediately and, if that’s not possible right away, cut off internet access to the affected endpoint while you plan the patch.

What to do — in detail

Confirm exposure and version
- Identify whether the business uses LiteLLM and determine the exact LiteLLM version.
- Verify whether the MCP Streamable HTTP endpoint is enabled in your LiteLLM deployment.
- Check whether the LiteLLM service is reachable from the internet (public IP, port forwarding, load balancer, or similar).
Determine if you’re affected
- You are affected if LiteLLM is prior to 1.84.0.
Upgrade remediation (primary fix)
- Upgrade LiteLLM to 1.84.0.
- Use your normal deployment process (container rebuild, package upgrade, or service redeploy) so the running service is actually updated.
- After upgrade, test MCP access using only legitimate LiteLLM credentials/keys to confirm expected authentication behavior.
If you cannot upgrade right away (temporary containment)
- Restrict network access so the MCP Streamable HTTP endpoint is not reachable from the internet.
- If you have a reverse proxy or firewall, lock it down to only trusted networks/IPs.
- Follow the vendor’s guidance referenced in the LiteLLM security advisory linked from the patch findings.
CISA due date and tracking
- CISA KEV remediation due date: 2026-09-16.
What to monitor
- Look for request logs on the MCP Streamable HTTP endpoint, especially requests with unusual or crafted Authorization headers.
- Monitor for unexpected MCP tool usage attempts that occur without corresponding valid LiteLLM key usage.

Technical context

Severity and risk posture: The reported issue is rated High (CVSS 8.2) and is classified as an authentication bypass.

CWE mapping: CWE-287 (Improper Authentication) and CWE-306 (Missing Authentication for Critical Function).

Mechanism: Before 1.84.0, an unauthenticated attacker can reach LiteLLM’s MCP Streamable HTTP endpoint remotely by sending a crafted Authorization header. This triggers an OAuth2 passthrough fallback path that replaces failed LiteLLM key validation with an empty authentication object (empty UserAPIKeyAuth()), allowing access to MCP tooling without a valid LiteLLM key.

Exploit status and KEV meaning: CVE-2026-59822 is listed in CISA KEV (added 2026-09-02), indicating confirmed real-world exploitation of the vulnerability class in the wild. That makes this urgent regardless of any public exploit availability.

Fixed version: LiteLLM is fixed in 1.84.0. No public exploit code was found in the provided findings.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS56th

CISA KEV

Listed as exploited in the wild since 2026-09-02.

US federal agencies must remediate by 2026-09-16.

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.8% chance of exploitation activity in the next 30 days, which ranks it in the 56th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

23 events over 65 days, from the signal feeds we watch.

2026-09-11Analysis publishedKestra's Login Bypass Was One Line of Code. Attackers Mined Crypto With It for Two Months Before CISA Noticed.
2026-09-03Patch availableworkaround available, record updated
2026-09-02Added to CISA KEVopenvas check added, patch available, patch available, workaround available, workaround available, record updated, record updated
2026-08-28Patch availableworkaround available, record updated
2026-07-13Patch availableworkaround available, record updated
2026-07-09Record updated

Affected products

BerriAIcommercialaka berriai/litellm, litellm
- litellmSaaSAI / ML / llm-serving-inference
litellmoss-project
- litellmMixedAI / ML / llm-serving-inference

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Scored 8.2 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity LowData modification is possible but limited in scope or consequence
Availability NoneNo availability impact