LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback
LiteLLM
More for LiteLLM RSS feed for LiteLLM
- Severity
- High, CVSS 8.2
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
- Record
- CVE-2026-59822
- Affects
- LiteLLM
- Known exploited
- Yes, listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- July 8, 2026
- Source last modified
- October 25, 2026
Description
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.84.0, LiteLLM's MCP Streamable HTTP endpoint allowed an unauthenticated attacker to use a fabricated Authorization header to trigger an OAuth2 passthrough fallback path that replaced failed LiteLLM key validation with an empty UserAPIKeyAuth() object, allowing requests to reach MCP tooling without a valid LiteLLM key. This issue is fixed in version 1.84.0.
Description quoted from the NVD record.
Who is affected
LiteLLM, made by BerriAI, is a gateway that lets your apps reach AI language model services through one central point. This flaw affects versions before 1.84.0, in the part that connects AI assistants to outside tools (known as MCP). An attacker with no login could send a faked sign-in detail with a web request and slip past the key check, reaching the connected tools without a valid LiteLLM key. This flaw is rated High. It is on CISA's Known Exploited Vulnerabilities list, which means attacks using it have been seen.
What to do
- If you are not sure whether your organization uses LiteLLM, ask the person who set up your AI tools or your IT provider to check which version is running.
- The person who installed or runs LiteLLM for your organization should act on this flaw now, since attacks using it have been seen.
- Update LiteLLM to version
1.84.0or later, which fixes this flaw. - If an IT provider or vendor runs LiteLLM for you, send them this advisory and ask when the update will be done.
Analysis written from the source record as of October 25, 2026 and reviewed before publishing.