CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

BerriAI LiteLLM, MCP OAuth2-passthrough fallback auth bypass, CISA KEV 2026-09-02

cve · CVE-2026-59822

Coverage
1
first 2026-09-03 → last 2026-09-03
Latest activity
2026-09-03
LiteLLM's MCP OAuth2-passthrough fallback authenticates a request it could not validate
Peak priority
high
1 high
Targets
technology
sectors: technology, public-sector
Sources cited
2
2 hosts

Action items (1)

Do-now tasks recorded on the entries about CVE-2026-59822, newest first. Check the date before acting on an older one.

  • Upgrade every LiteLLM gateway to ≥ 1.84.0 now; where an immediate upgrade is not possible, block /mcp/ and related MCP-endpoint paths at the reverse proxy or API gateway in front of it.
    2026-09-03CVE-2026-59822

Defender insights

What each entry about CVE-2026-59822 tells a defender to do, newest first.

2026-09-03HIGHexploitedLiteLLM's MCP OAuth2-passthrough fallback authenticates a request it could not validate

Triage

Story timeline

  1. 2026-09-03CVE-2026-59822, BerriAI LiteLLM: a failed key check on the MCP gateway substitutes an empty auth object instead of rejecting the request, so a fabricated Bearer token opens a live MCP session
    trending-vulnerabilitiesLiteLLM's MCP OAuth2-passthrough fallback authenticates a request it could not validate

Hunting pivots

Affected products
BerriAI LiteLLM
Tags
actively-exploitedai-abuseauth-bypasscisa-kevpatch-availablevulnerabilities
ATT&CK techniques (2 across 2 tactics)

2 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessExploit Public-Facing Application
  • Lateral MovementUse Alternate Authentication Material: Application Access Token

Initial Access TA0001

T1190Exploit Public-Facing Application×1

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-09-03/cve-2026-59822-litellm-mcp-oauth2-passthrough-auth-bypass · ATT&CK page ↗

Lateral Movement TA0008

T1550.001Use Alternate Authentication Material: Application Access Token×1

Adversaries may use stolen application access tokens to bypass the typical authentication process and access restricted accounts, information, or services on remote systems. These tokens are typically stolen from users or services and used in lieu of login credentials.

Evidence: 2026-09-03/cve-2026-59822-litellm-mcp-oauth2-passthrough-auth-bypass · ATT&CK page ↗

Entries about BerriAI LiteLLM, MCP OAuth2-passthrough fallback auth bypass, CISA KEV 2026-09-02 (1)

2026-09-03 · view entry permalink →

HIGHCVE-2026-59822exploitedNATOB2

CVE-2026-59822, BerriAI LiteLLM: a failed key check on the MCP gateway substitutes an empty auth object instead of rejecting the request, so a fabricated Bearer token opens a live MCP session

LiteLLM is a widely deployed proxy/gateway that lets an organisation front many LLM providers behind one API and, via the Model Context Protocol (MCP), let connected AI agents call external tools through it. Its MCP Streamable HTTP endpoint supports an OAuth2-passthrough mode for upstream MCP servers; the flaw sits in what happens when the gateway's own key check fails. Instead of rejecting the request, the fallback path replaces the failed validation with an empty UserAPIKeyAuth() object, which the rest of the request pipeline treats as a legitimately authenticated session (BerriAI, via OSV.dev). An attacker who sends any fabricated Authorization: Bearer value (no valid LiteLLM key required) therefore establishes a working MCP session and can list and invoke every MCP tool and connected service the gateway exposes (BerriAI, via OSV.dev). CISA's KEV addition on 2026-09-02 confirms this is under active exploitation, not merely disclosed (CISA Known Exploited Vulnerabilities catalog, 2026-09-02). Fixed in 1.84.0; where an immediate upgrade is not possible, BerriAI's own guidance is to block /mcp/ and related MCP endpoints at the reverse proxy or API gateway in front of LiteLLM (BerriAI, via OSV.dev).

This is a distinct code path from two other recently covered LiteLLM/MCP-surface flaws: CVE-2026-42271 was a command injection through MCP stdio test endpoints, chained with the Starlette host-header bypass CVE-2026-48710 in a real production intrusion Microsoft documented in August. CVE-2026-59822 hits the Streamable HTTP transport's OAuth2 fallback logic instead, a different mechanism on the same class of MCP-facing attack surface, not a re-run of the earlier bug.

Triage: an MCP session that never completed a valid key check but is nonetheless treated as authenticated is the tell; any environment logging MCP-gateway auth decisions should flag sessions where the presented Bearer token does not match an issued LiteLLM key yet the request pipeline proceeds past the auth stage.

LiteLLM's MCP Streamable HTTP endpoint could allow an unauthenticated attacker to establish an authenticated MCP session using an arbitrary Bearer token. The MCP auth handler supported OAuth2 passthrough for upstream MCP servers, but the fallback path could replace failed LiteLLM key validation with an empty UserAPIKeyAuth() object. This allowed requests with a fabricated Authorization header to reach MCP tooling without a valid LiteLLM key.

If upgrading is not immediately possible, disable MCP routes or block access to /mcp/ and related MCP endpoints at your reverse proxy or API gateway.

BerriAI (GitHub Security Advisory GHSA-7488-6r32-c95q, mirrored via OSV.dev) 2026-07-22

Builds on: CVE-2026-42271, BerriAI LiteLLM: low-privilege command injection to host RCE, added to CISA KEV · Three unrelated AI platforms, three intrusions, one pattern: gateways and orchestrators…

vulnerability03 Sep 05:08Zmulti-sourceOpen finding →
Sources: BerriAI (GitHub Security Advisory GHSA-7488-6r32-c95q, mirrored via OSV.dev) · CISA (Known Exploited Vulnerabilities catalog)

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Vulns1

Source distribution

  • cisa.gov1 (50%)
  • osv.dev1 (50%)

External references

NVD · cve.org · CISA KEV

All cited sources (2)