CVE-2026-59822 Details
Description
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.84.0, LiteLLM's MCP Streamable HTTP endpoint allowed an unauthenticated attacker to use a fabricated Authorization header to trigger an OAuth2 passthrough fallback path that replaced failed LiteLLM key validation with an empty UserAPIKeyAuth() object, allowing requests to reach MCP tooling without a valid LiteLLM key. This issue is fixed in version 1.84.0.
A vulnerability in LiteLLM prior to version 1.84.0 allows unauthenticated attackers to bypass authentication on the MCP Streamable HTTP endpoint. By sending a fabricated Authorization header, attackers can trigger an OAuth2 passthrough fallback that replaces failed LiteLLM key validation with an empty UserAPIKeyAuth object. This allows requests to access MCP tooling without a valid LiteLLM key. The vulnerability is present in versions of LiteLLM through 1.84.0.
Users are advised to upgrade to LiteLLM version 1.84.0 or later. If an immediate upgrade is not possible, MCP routes can be disabled or access to the '/mcp/' endpoint can be blocked at the reverse proxy or API gateway.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Sep 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-59822 | CISA-ADP | US Government Resource |
| https://www.wiz.io/blog/ai-infrastructure-honeypot | CISA-ADP | Third Party Advisory |
| https://github.com/BerriAI/litellm/commit/73869f0faf7d11ee21adcb5f91b8c33a340b6c2c | [email protected] | Patch |
| https://github.com/BerriAI/litellm/pull/26463 | [email protected] | Issue TrackingPatch |
| https://github.com/BerriAI/litellm/releases/tag/v1.84.0 | [email protected] | ProductRelease Notes |
| https://github.com/BerriAI/litellm/security/advisories/GHSA-7488-6r32-c95q | [email protected] | MitigationPatchVendor Advisory |
This CVE is in CISA's Known Exploited Vulnerabilities Catalog
Reference CISA's BOD 22-01 and Known Exploited Vulnerabilities Catalog for further guidance and requirements.
| Vulnerability Name | Date Added | Due Date | Required Action |
|---|---|---|---|
| BerriAI LiteLLM Improper Authentication Vulnerability | Sep 2, 2026 | Sep 16, 2026 | Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-287 | Improper Authentication | [email protected] |
| CWE-306 | Missing Authentication for Critical Function | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| litellm litellm | < 1.84.0 |
CPE
Remediation
| |
Change History
9 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 3, 2026 | CVE Modified | CISA-ADP |
| Sep 2, 2026 | Modified Analysis | [email protected] |
| Sep 2, 2026 | CVE CISA KEV Update | Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government |
| Sep 2, 2026 | CVE Modified | CISA-ADP |
| Aug 28, 2026 | CVE Modified | CISA-ADP |
| Aug 28, 2026 | CVE Modified | [email protected] |
| Jul 13, 2026 | Initial Analysis | [email protected] |
| Jul 9, 2026 | CVE Modified | CISA-ADP |
| Jul 8, 2026 | New CVE Received | [email protected] |