CVE-2026-59822: LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback
Impact LiteLLM's MCP Streamable HTTP endpoint could allow an unauthenticated attacker to establish an authenticated MCP session using an arbitrary Bearer token. The MCP auth handler supported OAuth2 passthrough for upstream MCP servers, but the fallback path could replace failed LiteLLM key validation with an empty UserAPIKeyAuth() object.
Published Jul 22, 2026
Affected packages
litellm
- Ecosystem
- PyPI
- Affected
- < 1.84.0
- Fixed in
- 1.84.0
- Check
pip show litellm
Required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
Impact
LiteLLM's MCP Streamable HTTP endpoint could allow an unauthenticated attacker to establish an authenticated MCP session using an arbitrary Bearer token.
The MCP auth handler supported OAuth2 passthrough for upstream MCP servers, but the fallback path could replace failed LiteLLM key validation with an empty UserAPIKeyAuth() object. This allowed requests with a fabricated Authorization header to reach MCP tooling without a valid LiteLLM key.
An attacker could use this to list and call configured MCP tools and access connected services exposed through MCP.
Patches
The issue is fixed in 1.84.0.
We recommend upgrading to 1.84.0 or later.
Workarounds
If upgrading is not immediately possible, disable MCP routes or block access to /mcp/ and related MCP endpoints at your reverse proxy or API gateway.
References
Credited to yaaras.
References
- https://github.com/BerriAI/litellm/security/advisories/GHSA-7488-6r32-c95q
- https://nvd.nist.gov/vuln/detail/CVE-2026-59822
- https://github.com/BerriAI/litellm/pull/26463
- https://github.com/BerriAI/litellm/commit/73869f0faf7d11ee21adcb5f91b8c33a340b6c2c
- https://github.com/BerriAI/litellm/releases/tag/v1.84.0
- https://github.com/advisories/GHSA-7488-6r32-c95q
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology
More LiteLLM vulnerabilities
All LiteLLM entriesCVE-2026-84377
LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parameters
medium6.5Sep 30, 2026CVE-2026-59823
LiteLLM Proxy has server-side request forgery via the `user_config` request parameter
medium5.3Sep 17, 2026CVE-2026-37004
LiteLLM vulnerable to server-side template injection in the /prompts/test endpoint
critical9.8Aug 27, 2026CVE-2026-59819
LiteLLM: Local file read via request-supplied OIDC file references
low2.1Jul 22, 2026CVE-2026-59820
LiteLLM: Arbitrary file write via path traversal in Skills archive extraction
medium6.1Jul 22, 2026CVE-2026-59821
LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks
low2.1Jul 22, 2026