NewApp Monitoring is liveSign up free
AgentbeamBeta
AI agent vulnerability · LiteLLM

CVE-2026-59822: LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback

highCVSS 4.0 8.8ExploitedGHSA-7488-6r32-c95q

LiteLLM before 1.84.0 let an unauthenticated attacker open an authenticated MCP session on the Streamable HTTP endpoint with any made-up Bearer token. The attacker can then list and call configured MCP tools. CISA lists it as exploited. Upgrade to 1.84.0.

Published Jul 22, 2026 · Analysis Oct 24, 2026

What an attacker can do

LiteLLM's MCP auth handler supports OAuth2 passthrough to upstream MCP servers. In that fallback path, a failed LiteLLM key check could be replaced with an empty UserAPIKeyAuth() object. A request with a fabricated Authorization: Bearer ... header then reached MCP tooling as if it were authenticated.

The attacker needs network access to a LiteLLM proxy that exposes its MCP routes, and no credentials. They get the MCP tools the proxy has configured and the services behind them. That can include databases, ticketing systems, code hosts, internal APIs or file access, depending on what operators connected. They can both list tools and call them, so impact covers reading data and taking actions with the connected services' own credentials.

The CVSS 4.0 vector rates confidentiality impact high and integrity low. Because the proxy often sits between AI agents and many tools, a bypass here gives broad reach for little effort.

Who is affected

The litellm pip package before 1.84.0, on proxy deployments that expose MCP Streamable HTTP routes such as /mcp/. Deployments that do not configure MCP are not exposed through this path.

pip show litellm

For Docker, check the image tag. Look for mcp_servers in your proxy config to see whether MCP is in use.

litellm

Ecosystem
PyPI
Affected
< 1.84.0
Fixed in
1.84.0
Check
pip show litellm

How to fix it

Upgrade to 1.84.0 or later.

pip install --upgrade litellm

If you cannot upgrade right away, the advisory says to disable MCP routes or block /mcp/ and related MCP endpoints at your reverse proxy or API gateway.

CISA's required action is to apply mitigations per vendor instructions under BOD 26-04 and its forensics triage requirements, or to discontinue use if mitigations are unavailable. The due date for US federal agencies was 2026-09-16. After patching, rotate credentials held by connected MCP servers if you saw suspicious access.

CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

How to tell if you were hit

Review proxy access logs for requests to /mcp/ that carry a Bearer token which is not a valid LiteLLM key, followed by successful tool listing or tool-call responses. Check upstream MCP servers and connected services for calls you cannot map to a known user or key, particularly from unfamiliar source addresses. Compare MCP tool-call activity against your issued keys.

Original advisory

From the GitHub Advisory Database (CC BY 4.0).

Impact

LiteLLM's MCP Streamable HTTP endpoint could allow an unauthenticated attacker to establish an authenticated MCP session using an arbitrary Bearer token.

The MCP auth handler supported OAuth2 passthrough for upstream MCP servers, but the fallback path could replace failed LiteLLM key validation with an empty UserAPIKeyAuth() object. This allowed requests with a fabricated Authorization header to reach MCP tooling without a valid LiteLLM key.

An attacker could use this to list and call configured MCP tools and access connected services exposed through MCP.

Patches

The issue is fixed in 1.84.0.

We recommend upgrading to 1.84.0 or later.

Workarounds

If upgrading is not immediately possible, disable MCP routes or block access to /mcp/ and related MCP endpoints at your reverse proxy or API gateway.

References

Credited to yaaras.

Questions

Is CVE-2026-59822 exploited in the wild?

Yes. CISA added it to the Known Exploited Vulnerabilities catalog on 2026-09-02. No ransomware use is flagged.

Does the attacker need a valid LiteLLM key?

No. Any fabricated Bearer value worked because failed validation fell back to an empty UserAPIKeyAuth() object.

What is the quickest mitigation?

Upgrade to 1.84.0. If you cannot, disable MCP routes or block /mcp/ and related endpoints at your reverse proxy or API gateway.

Are LiteLLM deployments without MCP affected?

The flaw is in the MCP endpoint's auth handler. A deployment with no MCP routes exposed does not give an attacker this path.

References

Read for this analysis:

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. The analysis is written by an AI model from the sources listed above and checked by automated rules before it is published. Check versions against the vendor's advisory before you act. Methodology

More LiteLLM vulnerabilities

All LiteLLM entries