LiteLLM AI gateway login bypass on MCP endpoint (CVE-2026-59822) used in attacks; fixed in 1.84.0
LiteLLM's MCP endpoint accepted any made-up Bearer token as a valid login (CVE-2026-59822). CISA lists it as exploited. Anyone running LiteLLM before 1.84.0 should upgrade, or block /mcp/ at the proxy until they can.
If you run LiteLLM, upgrade to 1.84.0 or later and restart or redeploy so the new version is live. If you can't upgrade yet, disable MCP routes or block /mcp/ at your reverse proxy, and review MCP logs and the credentials those tools hold. Nothing to do if you don't run LiteLLM.
What’s happening
CVE-2026-59822 is an authentication flaw in LiteLLM, an open-source gateway many organisations use to route requests to AI models. In versions before 1.84.0, the MCP Streamable HTTP endpoint handled a failed key check by falling back to an empty authenticated identity. An attacker with network access and a fabricated Bearer token could start an authenticated MCP session, then list and call the MCP tools configured on the gateway and reach the services behind them. BerriAI published its advisory on 30 June 2026 with the fix in LiteLLM 1.84.0. CISA added the flaw to its list of vulnerabilities being used in attacks on 2 September 2026. Secondary reports say Wiz Research saw exploitation in its honeypots and found hundreds of exposed deployments, but we haven't confirmed that against Wiz's own report. The vendor advisory scores it 8.8 (CVSS 4.0); NVD scores it 8.2 (CVSS 3.1). It mainly affects businesses and developers who self-host LiteLLM, not ordinary home users.
- What
- Flaw
- Affects
- BerriAI LiteLLM (AI gateway / proxy server)
- Affected
- LiteLLM (pip package litellm) versions before 1.84.0
- Fixed in
- 1.84.0
- Since
- 2 Sept 2026
- Closed
- 18 Sept 2026
Timeline
- Wider attacks
A secondary write-up reports that Wiz Research observed exploitation in its honeypots in September 2026 and found the flaw exploitable across hundreds of internet-facing deployments it examined. This is not confirmed from Wiz's own report, and another summary gives a different observation date.
- CISA added
CISA added CVE-2026-59822 to its Known Exploited Vulnerabilities catalog. A secondary write-up gives a federal agency patch deadline of 16 September 2026.
- Made publicFixed
BerriAI published advisory GHSA-7488-6r32-c95q for CVE-2026-59822: LiteLLM's MCP Streamable HTTP endpoint could let an unauthenticated attacker start an authenticated session with a made-up Bearer token. It listed LiteLLM before 1.84.0 as affected and 1.84.0 as the fix. The advisory did not say whether the flaw was being exploited.
Sources
- MCP Authentication Bypass via OAuth2 Passthrough Fallback (GHSA-7488-6r32-c95q)BerriAI · 30 June 2026
- CVE-2026-59822 LiteLLM MCP authentication bypassPenligent · 18 Sept 2026
- Wiz Finds 294 LiteLLM Gateways Still Accept sk-1234 Default KeyAI Weekly · 1 Sept 2026