--- schema: 1 kind: vulnerability title: "CVE-2026-59822 — BerriAI LiteLLM: a failed key check on the MCP gateway substitutes an empty auth object instead of rejecting the request, so a fabricated Bearer token opens a live MCP session" headline: "LiteLLM's MCP OAuth2-passthrough fallback authenticates a request it could not validate" summary: > CISA added CVE-2026-59822 (CVSS 4.0 8.8) to its Known Exploited Vulnerabilities catalog on 2026-09-02, confirming exploitation of an authentication bypass in LiteLLM's MCP Streamable HTTP endpoint: on failed key validation, the OAuth2-passthrough fallback substitutes an empty auth object rather than rejecting the request, so an unauthenticated attacker with any fabricated Bearer token can list and invoke every MCP tool the gateway exposes. Fixed in 1.84.0; it is the third distinct LiteLLM/MCP-surface CVE to reach confirmed exploitation in three months. discovered_at: "2026-09-03T05:08:00Z" updated_at: null event_date: "2026-09-02" run_id: 2026-09-03T0410Z-intel priority: high immediate_action: null tags: [vulnerabilities, auth-bypass, actively-exploited, cisa-kev, patch-available, ai-abuse] regions: [global] sectors: [technology, public-sector] entities: [] techniques: [T1190, T1550.001] affected_products: ["BerriAI LiteLLM"] cves: - id: CVE-2026-59822 cvss: "8.8 (CVSS4.0)" epss: null type: auth-bypass vector: zero-click auth: pre-auth status: [exploited, cisa-kev, patch-available] affected: "LiteLLM < 1.84.0" fixed: "1.84.0" sources: - url: "https://osv.dev/vulnerability/GHSA-7488-6r32-c95q" publisher: "BerriAI (GitHub Security Advisory GHSA-7488-6r32-c95q, mirrored via OSV.dev)" date: "2026-07-22" role: primary - url: "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json" publisher: "CISA (Known Exploited Vulnerabilities catalog)" date: "2026-09-02" role: corroborating closed_sources: [] evidence: - quote: "LiteLLM's MCP Streamable HTTP endpoint could allow an unauthenticated attacker to establish an authenticated MCP session using an arbitrary Bearer token. The MCP auth handler supported OAuth2 passthrough for upstream MCP servers, but the fallback path could replace failed LiteLLM key validation with an empty `UserAPIKeyAuth()` object. This allowed requests with a fabricated `Authorization` header to reach MCP tooling without a valid LiteLLM key." publisher: "BerriAI (GitHub Security Advisory GHSA-7488-6r32-c95q, mirrored via OSV.dev)" - quote: "If upgrading is not immediately possible, disable MCP routes or block access to `/mcp/` and related MCP endpoints at your reverse proxy or API gateway." publisher: "BerriAI (GitHub Security Advisory GHSA-7488-6r32-c95q, mirrored via OSV.dev)" verification: multi-source sourcing_note: > BerriAI's own advisory is the sole source for the vulnerability mechanism; CISA's KEV listing independently corroborates only that the CVE is exploited, not the technical mechanism itself. Credibility held at 2 rather than 1 on that basis. confidence: high references: - 2026-06-09/cve-2026-42271-berriai-litellm-low-privilege-command-injecti - 2026-08-31/ai-infrastructure-litellm-ragflow-kestra-intrusions deep_dive: false deep_dive_category: null org_triage: null classification: reliability: B credibility: 2 watchlist_hit: false actions: - "Upgrade every LiteLLM gateway to ≥ 1.84.0 now; where an immediate upgrade is not possible, block `/mcp/` and related MCP-endpoint paths at the reverse proxy or API gateway in front of it." updates: [] migrated_from: null --- LiteLLM is a widely deployed proxy/gateway that lets an organisation front many LLM providers behind one API and, via the Model Context Protocol (MCP), let connected AI agents call external tools through it. Its MCP Streamable HTTP endpoint supports an OAuth2-passthrough mode for upstream MCP servers; the flaw sits in what happens when the gateway's own key check fails. Instead of rejecting the request, the fallback path replaces the failed validation with an empty `UserAPIKeyAuth()` object, which the rest of the request pipeline treats as a legitimately authenticated session ([BerriAI, via OSV.dev](https://osv.dev/vulnerability/GHSA-7488-6r32-c95q)). An attacker who sends any fabricated `Authorization: Bearer` value — no valid LiteLLM key required — therefore establishes a working MCP session and can list and invoke every MCP tool and connected service the gateway exposes ([BerriAI, via OSV.dev](https://osv.dev/vulnerability/GHSA-7488-6r32-c95q)). CISA's KEV addition on 2026-09-02 confirms this is under active exploitation, not merely disclosed ([CISA Known Exploited Vulnerabilities catalog, 2026-09-02](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)). Fixed in 1.84.0; where an immediate upgrade is not possible, BerriAI's own guidance is to block `/mcp/` and related MCP endpoints at the reverse proxy or API gateway in front of LiteLLM ([BerriAI, via OSV.dev](https://osv.dev/vulnerability/GHSA-7488-6r32-c95q)). This is a distinct code path from two other recently covered LiteLLM/MCP-surface flaws: CVE-2026-42271 was a command injection through MCP stdio test endpoints, chained with the Starlette host-header bypass CVE-2026-48710 in a real production intrusion Microsoft documented in August. CVE-2026-59822 hits the Streamable HTTP transport's OAuth2 fallback logic instead — a different mechanism on the same class of MCP-facing attack surface, not a re-run of the earlier bug. **Triage:** an MCP session that never completed a valid key check but is nonetheless treated as authenticated is the tell — any environment logging MCP-gateway auth decisions should flag sessions where the presented Bearer token does not match an issued LiteLLM key yet the request pipeline proceeds past the auth stage. **Defender takeaway:** any organisation self-hosting a LiteLLM gateway — including public-sector agencies running internal LLM/agent pipelines — should treat every unpatched instance as reachable by an unauthenticated caller into whatever MCP tools it fronts, and upgrade or restrict access immediately rather than waiting for a scheduled maintenance window.