CVE-2026-59822 Overview
CVE-2026-59822 is an authentication bypass vulnerability [CWE-287] in LiteLLM, a proxy server (AI Gateway) used to call Large Language Model (LLM) APIs in OpenAI or native format. Versions prior to 1.84.0 contain a flaw in the Model Context Protocol (MCP) Streamable HTTP endpoint. An unauthenticated attacker can supply a fabricated Authorization header to trigger an OAuth2 passthrough fallback path. This fallback replaces failed LiteLLM key validation with an empty UserAPIKeyAuth() object, allowing requests to reach MCP tooling without a valid LiteLLM key. The issue is resolved in version 1.84.0.
Critical Impact
Unauthenticated network attackers can reach MCP tooling behind the LiteLLM gateway, exposing backend LLM APIs and connected tools without valid credentials.
Affected Products
- LiteLLM (BerriAI) versions prior to 1.84.0
- LiteLLM MCP Streamable HTTP endpoint
- Deployments using OAuth2 passthrough configuration
Discovery Timeline
- 2026-07-08 - CVE-2026-59822 published to NVD
- 2026-07-08 - Last updated in NVD database
Technical Details for CVE-2026-59822
Vulnerability Analysis
LiteLLM exposes an MCP Streamable HTTP endpoint that authenticates callers using a LiteLLM-issued API key delivered in the Authorization header. When key validation fails, the code path falls back to OAuth2 passthrough logic intended to accept upstream provider tokens. The fallback does not verify the fabricated bearer token before assigning an empty UserAPIKeyAuth() object to the request context. The empty auth object is treated as a successful authentication result, so downstream MCP tool invocations execute as if the caller possessed a valid key.
The vulnerability is exploitable remotely over the network without user interaction and without prior authentication. Successful exploitation grants access to MCP-registered tools, LLM proxy routes, and any data those tools can reach.
Root Cause
The root cause is improper authentication [CWE-287] in the MCP endpoint's fallback logic. When LiteLLM key validation raises an error, the OAuth2 passthrough branch substitutes an empty UserAPIKeyAuth() instead of rejecting the request or verifying the supplied token against an OAuth2 provider. The empty auth object bypasses subsequent authorization checks that assume upstream validation succeeded.
Attack Vector
The attack requires only network access to the LiteLLM MCP Streamable HTTP endpoint. An attacker sends an HTTP request to the MCP endpoint with a fabricated Authorization: Bearer <arbitrary-value> header. LiteLLM's key validation fails, triggers the OAuth2 passthrough fallback, and returns an empty UserAPIKeyAuth() object. The request then proceeds to invoke MCP tooling. No credentials, prior access, or social engineering are required. Refer to the GitHub Security Advisory GHSA-7488-6r32-c95q for full technical details.
Detection Methods for CVE-2026-59822
Indicators of Compromise
- Requests to the MCP Streamable HTTP endpoint containing Authorization headers that do not correspond to issued LiteLLM keys
- MCP tool invocations lacking a resolvable user or key identifier in LiteLLM audit logs
- Unexpected spikes in MCP endpoint traffic from previously unseen source IP addresses
- Log entries showing key validation failures immediately followed by successful MCP tool execution
Detection Strategies
- Correlate LiteLLM authentication failure events with subsequent successful MCP tool calls in the same request flow
- Alert on MCP requests where the resolved UserAPIKeyAuth object contains empty or default fields
- Compare presented bearer tokens against the set of issued LiteLLM API key hashes and flag mismatches
Monitoring Recommendations
- Enable verbose request logging on the LiteLLM proxy and forward logs to a centralized SIEM for retention and analysis
- Monitor egress from LiteLLM hosts to backend LLM providers for volume anomalies indicating unauthorized proxy use
- Track MCP tool execution counts per authenticated key and alert on tool calls with no attributable key
How to Mitigate CVE-2026-59822
Immediate Actions Required
- Upgrade LiteLLM to version 1.84.0 or later using the GitHub Release v1.84.0
- Rotate any LiteLLM API keys and downstream provider credentials that may have been exposed through the MCP endpoint
- Review MCP tool invocation logs for unauthorized activity since the endpoint was first exposed
- Restrict network access to the LiteLLM MCP endpoint to trusted networks until patching is complete
Patch Information
BerriAI fixed the vulnerability in LiteLLM version 1.84.0. The remediation is tracked in GitHub Pull Request #26463 and applied in commit 73869f0. The fix ensures the OAuth2 passthrough fallback validates supplied tokens instead of substituting an empty UserAPIKeyAuth() object.
Workarounds
- Disable the MCP Streamable HTTP endpoint if it is not required for production workloads
- Place LiteLLM behind an authenticating reverse proxy that enforces mutual TLS or a validated bearer token before requests reach the LiteLLM process
- Disable the OAuth2 passthrough configuration until upgrading to version 1.84.0
- Apply network-level allowlists limiting MCP endpoint access to known client IP ranges
# Upgrade LiteLLM to the patched release
pip install --upgrade "litellm>=1.84.0"
# Verify installed version
python -c "import litellm; print(litellm.__version__)"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
