{"id":"litellm-mcp-auth-bypass-cve-2026-59822-jun","category":"patch","status":"closed","title":"LiteLLM AI gateway login bypass on MCP endpoint (CVE-2026-59822) used in attacks; fixed in 1.84.0","tldr":"LiteLLM's MCP endpoint accepted any made-up Bearer token as a valid login (CVE-2026-59822). CISA lists it as exploited. Anyone running LiteLLM before 1.84.0 should upgrade, or block /mcp/ at the proxy until they can.","summary":"CVE-2026-59822 is an authentication flaw in LiteLLM, an open-source gateway many organisations use to route requests to AI models. In versions before 1.84.0, the MCP Streamable HTTP endpoint handled a failed key check by falling back to an empty authenticated identity. An attacker with network access and a fabricated Bearer token could start an authenticated MCP session, then list and call the MCP tools configured on the gateway and reach the services behind them. BerriAI published its advisory on 30 June 2026 with the fix in LiteLLM 1.84.0. CISA added the flaw to its list of vulnerabilities being used in attacks on 2 September 2026. Secondary reports say Wiz Research saw exploitation in its honeypots and found hundreds of exposed deployments, but we haven't confirmed that against Wiz's own report. The vendor advisory scores it 8.8 (CVSS 4.0); NVD scores it 8.2 (CVSS 3.1). It mainly affects businesses and developers who self-host LiteLLM, not ordinary home users.","action":"If you run LiteLLM, upgrade to 1.84.0 or later and restart or redeploy so the new version is live. If you can't upgrade yet, disable MCP routes or block /mcp/ at your reverse proxy, and review MCP logs and the credentials those tools hold. Nothing to do if you don't run LiteLLM.","product":"BerriAI LiteLLM (AI gateway / proxy server)","audience":"work","severity":"high","patch":"patched","exploited":true,"cves":["CVE-2026-59822"],"tags":["litellm","berriai","ai-gateway","mcp","authentication-bypass","cisa-kev","pypi","exploited"],"affected":["LiteLLM (pip package litellm) versions before 1.84.0"],"fixed":["1.84.0"],"matches":[],"sources":[{"kind":"advisory","title":"MCP Authentication Bypass via OAuth2 Passthrough Fallback (GHSA-7488-6r32-c95q)","url":"https://github.com/BerriAI/litellm/security/advisories/GHSA-7488-6r32-c95q","by":"BerriAI","date":"2026-06-30"},{"kind":"news","title":"CVE-2026-59822 LiteLLM MCP authentication bypass","url":"https://www.penligent.ai/hackinglabs/es/?p=7505","by":"Penligent","date":"2026-09-18"},{"kind":"news","title":"Wiz Finds 294 LiteLLM Gateways Still Accept sk-1234 Default Key","url":"https://aiweekly.co/alerts/wiz-finds-294-litellm-gateways-still-accept-sk-1234-default-key","by":"AI Weekly","date":"2026-09-01"}],"started":"2026-09-02","closed":"2026-09-18","created":"2026-11-03T22:09:43.516Z","updated":"2026-11-03T22:09:43.516Z","cve_notes":[{"cve":"CVE-2026-59822","name":"Login bypass on LiteLLM's MCP endpoint","what":"An improper authentication flaw in LiteLLM's MCP Streamable HTTP endpoint, where a failed key check fell back to an empty identity so a made-up Bearer token gave an unauthenticated attacker a working session to list and call MCP tools and reach the connected services.","severity":"high","cvss":8.8}],"timeline":[{"at":"2026-09-18","added":"2026-11-03T22:05:27.736Z","kind":"wider-attacks","text":"A secondary write-up reports that Wiz Research observed exploitation in its honeypots in September 2026 and found the flaw exploitable across hundreds of internet-facing deployments it examined. This is not confirmed from Wiz's own report, and another summary gives a different observation date.","url":"https://www.penligent.ai/hackinglabs/es/?p=7505","by":"Penligent","patch":null},{"at":"2026-09-02","added":"2026-11-03T22:05:27.736Z","kind":"cisa-added","text":"CISA added CVE-2026-59822 to its Known Exploited Vulnerabilities catalog. A secondary write-up gives a federal agency patch deadline of 16 September 2026.","url":"https://www.penligent.ai/hackinglabs/es/?p=7505","by":"Penligent","patch":null},{"at":"2026-06-30","added":"2026-11-03T22:05:27.736Z","kind":"disclosed","text":"BerriAI published advisory GHSA-7488-6r32-c95q for CVE-2026-59822: LiteLLM's MCP Streamable HTTP endpoint could let an unauthenticated attacker start an authenticated session with a made-up Bearer token. It listed LiteLLM before 1.84.0 as affected and 1.84.0 as the fix. The advisory did not say whether the flaw was being exploited.","url":"https://github.com/BerriAI/litellm/security/advisories/GHSA-7488-6r32-c95q","by":"BerriAI (GitHub Security Advisory)","patch":"patched"}],"url":"https://hard.fyi/live/litellm-mcp-auth-bypass-cve-2026-59822-jun/","json":"https://hard.fyi/api/live?id=litellm-mcp-auth-bypass-cve-2026-59822-jun"}