{"id":"CVE-2026-59822","kind":"vulnerability","aliases":["CVE-2026-59822"],"related":[],"title":"LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format","description":"BerriAI LiteLLM contains an improper authentication vulnerability in the MCP Streamable HTTP endpoint that could allow an unauthenticated attacker to establish an authenticated MCP session using an arbitrary Bearer token.\n\nCISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","summary":"LiteLLM's MCP Streamable HTTP endpoint (/mcp/) accepts a fabricated Bearer token. The OAuth2 passthrough fallback replaced failed LiteLLM key validation with an empty UserAPIKeyAuth(). An unauthenticated attacker can list and call configured MCP tools and reach the services behind them. Fixed in 1.84.0. CISA KEV lists it as exploited.","severity":"high","cvss":8.8,"epss":null,"exploited":true,"exploited_at":"2026-09-02T00:00:00+00:00","products":[{"name":"BerriAI LiteLLM","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"litellm","fixed":["1.84.0"],"affected":"< 1.84.0","ecosystem":"pypi"},{"name":"litellm","fixed":["1.84.0"],"affected":"< 1.84.0","ecosystem":"vendor"}],"ecosystems":["pypi","vendor"],"tags":["ai-tooling","exploited","litellm","mcp","python","self-hosted"],"not_affected_if":["litellm-1.84.0-or-later","litellm-below-affected-range","mcp-endpoint-not-exposed","mcp-endpoint-not-reachable","mcp-routes-disabled"],"how_to_check":"Run 'pip show litellm' or 'pip list | grep litellm' on the host or container. Any version below 1.84.0 is affected. Then check whether MCP routes are reachable: an unauthenticated request to your proxy's /mcp/ path with a made-up 'Authorization: Bearer x' header should return 401/403. If it returns tool data, you are exposed. Check proxy logs for /mcp/ requests with unknown keys.","fix":"Upgrade litellm to 1.84.0 or later. Workaround if you cannot upgrade: disable MCP routes, or block /mcp/ and related MCP endpoints at the reverse proxy or API gateway. If the endpoint was internet-exposed, treat the credentials of connected MCP services as possibly exposed and rotate them.","status":"open","published_at":"2026-07-08T20:16:57+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:57:11+00:00","updated_at":"2026-10-23T23:44:52+00:00","category":"ai-tooling","confidence":0.85,"triage":{"at":"2026-10-23T20:57:11Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade the litellm PyPI package to 1.84.0 or later.\nunknown","reach":"internet","impact":"medium","summary":"LiteLLM's MCP Streamable HTTP endpoint accepts an arbitrary Bearer token and treats it as a valid authenticated MCP session. An unauthenticated attacker can use the MCP endpoint as if they were a logged-in user.","category":"ai-tooling","who_cares":["litellm","mcp","self-hosted","python"],"confidence":0.7,"needs_auth":"no","worst_case":"Unauthenticated attacker gains authenticated MCP session on the LiteLLM proxy","analyst_note":"Confirm which MCP endpoint paths and default config expose the flaw, and find the vendor advisory for exact affected versions and a version-specific check; CISA KEV entry is at https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-59822","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["litellm-below-affected-range","mcp-endpoint-not-exposed"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000523,"input_tokens":3049,"output_tokens":436,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm which MCP endpoint paths and default config expose the flaw, and find the vendor advisory for exact affected versions and a version-specific check; CISA KEV entry is at https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-59822","search":"'-04':134C,160C,191C '-2026':18A,21A '-59822':19A,22A '/mcp':43B '1.84.0':80B '26':133C,159C,190C 'accept':44B 'accord':123C 'action':119C 'adher':187C 'ai':6A,28B 'ai-tool':27B 'allow':102C 'api':11A 'appli':120C 'applic':157C 'arbitrari':114C 'asset':181C 'attack':64B,105C 'authent':92C,109C 'base':138C 'bearer':47B,115C 'behind':76B 'berriai':23A,87C 'bod':132C,158C,189C 'call':9A,68B 'cisa':81B,117C,130C,147C 'cloud':163C 'complianc':128C 'configur':69B 'contain':89C 'could':101C 'cve':17A,20A 'discontinu':166C 'empti':60B 'endpoint':42B,99C 'ensur':127C,186C 'establish':107C 'evalu':179C 'exploit':30B,86B 'exposur':184C 'fabric':46B 'fail':54B 'fallback':52B 'fix':78B 'follow':156C 'forens':149C 'format':16A 'gateway':7A 'guidanc':145C,161C 'guidelin':193C 'host':36B 'http':41B,98C 'improp':91C 'instruct':126C 'internet':183C 'kev':82B 'key':56B 'list':66B,83B 'litellm':1A,24A,25A,26A,31B,37B,55B,88C 'llm':10A 'mcp':32B,39B,70B,96C,110C 'mitig':121C,172C 'nativ':15A 'note':144C,155C 'oauth2':50B 'openai':13A 'passthrough':51B 'patch':192C 'priorit':135C 'product':170C 'proxi':4A 'python':33B 'reach':73B 'replac':53B 'requir':118C,151C 'respons':177C 'risk':140C 'secur':136C 'see':141C,152C 'self':35B 'self-host':34B 'server':5A 'servic':75B,164C 'session':111C 'stakehold':175C 'streamabl':40B,97C 'token':48B,116C 'tool':29B,71B 'triag':150C 'unauthent':63B,104C 'unavail':174C 'updat':137C 'url':142C,153C 'use':112C,167C 'userapikeyauth':61B 'valid':57B 'vendor':125C 'vulner':93C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-07-08T20:16:57+00:00","kev":{"dateAdded":"2026-09-02","dueDate":"2026-09-16","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2026-59822","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-59822","severity":null,"published_at":"2026-09-02T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T12:39:21+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-59822:27","url":null,"severity":null,"published_at":"2026-10-23T20:48:43+00:00","modified_at":"2026-10-23T20:48:43+00:00","first_seen_at":"2026-10-23T20:48:43+00:00","fetched_at":"2026-10-23T20:48:43+00:00","note":"BerriAI advisory GHSA-7488-6r32-c95q: litellm < 1.84.0 affected, fixed in 1.84.0; CISA KEV added 2026-09-02. No public PoC link found. Whether MCP is on by default is not stated in the advisory (unknown)."},{"source":"analyst","external_id":"CVE-2026-59822:33","url":null,"severity":null,"published_at":"2026-10-23T20:57:53+00:00","modified_at":"2026-10-23T20:57:53+00:00","first_seen_at":"2026-10-23T20:57:53+00:00","fetched_at":"2026-10-23T20:57:53+00:00","note":"Read GHSA-7488-6r32-c95q: litellm < 1.84.0 affected, fixed in 1.84.0; the advisory page shows no CVE ID, so the CVE-to-GHSA mapping rests on the matching title and fix version. CISA KEV lists it as exploited since 2026-09-02. No public PoC found. Whether MCP is on by default is not stated (unknown)."},{"source":"nvd","external_id":"CVE-2026-59822","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59822","severity":null,"published_at":"2026-07-08T20:16:57+00:00","modified_at":"2026-09-03T13:05:59+00:00","first_seen_at":"2026-10-23T23:44:52+00:00","fetched_at":"2026-10-23T23:44:52+00:00","note":null}],"documents":[{"id":870,"url":"https://github.com/BerriAI/litellm/security/advisories/GHSA-7488-6r32-c95q","title":"GHSA-7488-6r32-c95q MCP Authentication Bypass via OAuth2 Passthrough Fallback","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":871,"url":"https://github.com/BerriAI/litellm/releases/tag/v1.84.0","title":"LiteLLM v1.84.0","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}