CTIPilot

BerriAI LiteLLM, MCP OAuth2-passthrough fallback auth bypass, CISA KEV 2026-09-02

cve · CVE-2026-59822

Coverage timeline
1
first 2026-09-03 → last 2026-09-03
Peak priority
high
1 high
Sources cited
2
2 hosts
Sections touched
1
trending-vulnerabilities
Co-occurring entities
1
see Co-occurring entities below
ATT&CK techniques
2
pinned v19.2 · see below

Hunting pivots

ATT&CK techniques
T1190T1550.001
Affected products
BerriAI LiteLLM
Tags
actively-exploitedai-abuseauth-bypasscisa-kevpatch-availablevulnerabilities

ATT&CK techniques

2 techniques observed across 1 entry, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v19.2 · compare on the matrix · Navigator layer (JSON)

Initial Access TA0001

T1190Exploit Public-Facing Application×1

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-09-03/cve-2026-59822-litellm-mcp-oauth2-passthrough-auth-bypass · ATT&CK page ↗

Lateral Movement TA0008

T1550.001Use Alternate Authentication Material: Application Access Token×1

Adversaries may use stolen application access tokens to bypass the typical authentication process and access restricted accounts, information, or services on remote systems. These tokens are typically stolen from users or services and used in lieu of login credentials.

Evidence: 2026-09-03/cve-2026-59822-litellm-mcp-oauth2-passthrough-auth-bypass · ATT&CK page ↗

Story timeline

  1. 2026-09-03CVE-2026-59822, BerriAI LiteLLM: a failed key check on the MCP gateway substitutes an empty auth object instead of rejecting the request, so a fabricated Bearer token opens a live MCP session
    trending-vulnerabilitiesLiteLLM's MCP OAuth2-passthrough fallback authenticates a request it could not validate

Where this entity is cited

  • trending-vulnerabilities1

Source distribution

  • cisa.gov1 (50%)
  • osv.dev1 (50%)

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

External references

NVD · cve.org · CISA KEV

All cited sources (2)

Entries about BerriAI LiteLLM, MCP OAuth2-passthrough fallback auth bypass, CISA KEV 2026-09-02 (1)

2026-09-03 · view entry permalink →

HIGHCVE-2026-59822exploitedNATOB2

CVE-2026-59822, BerriAI LiteLLM: a failed key check on the MCP gateway substitutes an empty auth object instead of rejecting the request, so a fabricated Bearer token opens a live MCP session

LiteLLM is a widely deployed proxy/gateway that lets an organisation front many LLM providers behind one API and, via the Model Context Protocol (MCP), let connected AI agents call external tools through it. Its MCP Streamable HTTP endpoint supports an OAuth2-passthrough mode for upstream MCP servers; the flaw sits in what happens when the gateway's own key check fails. Instead of rejecting the request, the fallback path replaces the failed validation with an empty UserAPIKeyAuth() object, which the rest of the request pipeline treats as a legitimately authenticated session (BerriAI, via OSV.dev). An attacker who sends any fabricated Authorization: Bearer value (no valid LiteLLM key required) therefore establishes a working MCP session and can list and invoke every MCP tool and connected service the gateway exposes (BerriAI, via OSV.dev). CISA's KEV addition on 2026-09-02 confirms this is under active exploitation, not merely disclosed (CISA Known Exploited Vulnerabilities catalog, 2026-09-02). Fixed in 1.84.0; where an immediate upgrade is not possible, BerriAI's own guidance is to block /mcp/ and related MCP endpoints at the reverse proxy or API gateway in front of LiteLLM (BerriAI, via OSV.dev).

This is a distinct code path from two other recently covered LiteLLM/MCP-surface flaws: CVE-2026-42271 was a command injection through MCP stdio test endpoints, chained with the Starlette host-header bypass CVE-2026-48710 in a real production intrusion Microsoft documented in August. CVE-2026-59822 hits the Streamable HTTP transport's OAuth2 fallback logic instead, a different mechanism on the same class of MCP-facing attack surface, not a re-run of the earlier bug.

Triage: an MCP session that never completed a valid key check but is nonetheless treated as authenticated is the tell; any environment logging MCP-gateway auth decisions should flag sessions where the presented Bearer token does not match an issued LiteLLM key yet the request pipeline proceeds past the auth stage.

LiteLLM's MCP Streamable HTTP endpoint could allow an unauthenticated attacker to establish an authenticated MCP session using an arbitrary Bearer token. The MCP auth handler supported OAuth2 passthrough for upstream MCP servers, but the fallback path could replace failed LiteLLM key validation with an empty UserAPIKeyAuth() object. This allowed requests with a fabricated Authorization header to reach MCP tooling without a valid LiteLLM key.

If upgrading is not immediately possible, disable MCP routes or block access to /mcp/ and related MCP endpoints at your reverse proxy or API gateway.

BerriAI (GitHub Security Advisory GHSA-7488-6r32-c95q, mirrored via OSV.dev) 2026-07-22

Builds on: 2026-06-09/cve-2026-42271-berriai-litellm-low-privilege-command-injecti · 2026-08-31/ai-infrastructure-litellm-ragflow-kestra-intrusions

vulnerability03 Sep 05:08Zmulti-sourceOpen finding ↗
Sources: BerriAI (GitHub Security Advisory GHSA-7488-6r32-c95q, mirrored via OSV.dev) · CISA (Known Exploited Vulnerabilities catalog)