---
id: "CVE-2026-59822"
kind: "vulnerability"
aliases: ["CVE-2026-59822"]
title: "LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format"
severity: "high"
cvss: 8.8
epss: null
exploited: true
status: "open"
category: "ai-tooling"
products: [{"name": "BerriAI LiteLLM", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "litellm", "fixed": ["1.84.0"], "affected": "< 1.84.0", "ecosystem": "pypi"}, {"name": "litellm", "fixed": ["1.84.0"], "affected": "< 1.84.0", "ecosystem": "vendor"}]
ecosystems: ["pypi", "vendor"]
tags: ["ai-tooling", "exploited", "litellm", "mcp", "python", "self-hosted"]
not_affected_if: ["litellm-1.84.0-or-later", "litellm-below-affected-range", "mcp-endpoint-not-exposed", "mcp-endpoint-not-reachable", "mcp-routes-disabled"]
published_at: "2026-07-08T20:16:57+00:00"
first_seen_at: "2026-10-23T19:11:51+00:00"
updated_at: "2026-10-23T23:44:52+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-59822", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T20:48:43+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T20:57:53+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59822", "first_seen_at": "2026-10-23T23:44:52+00:00"}]
---

# LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format

LiteLLM's MCP Streamable HTTP endpoint (/mcp/) accepts a fabricated Bearer token. The OAuth2 passthrough fallback replaced failed LiteLLM key validation with an empty UserAPIKeyAuth(). An unauthenticated attacker can list and call configured MCP tools and reach the services behind them. Fixed in 1.84.0. CISA KEV lists it as exploited.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:BerriAI LiteLLM affected ? fixed ?
- pypi:litellm affected < 1.84.0 fixed 1.84.0
- vendor:litellm affected < 1.84.0 fixed 1.84.0

## How to check

Run 'pip show litellm' or 'pip list | grep litellm' on the host or container. Any version below 1.84.0 is affected. Then check whether MCP routes are reachable: an unauthenticated request to your proxy's /mcp/ path with a made-up 'Authorization: Bearer x' header should return 401/403. If it returns tool data, you are exposed. Check proxy logs for /mcp/ requests with unknown keys.

## Fix

Upgrade litellm to 1.84.0 or later. Workaround if you cannot upgrade: disable MCP routes, or block /mcp/ and related MCP endpoints at the reverse proxy or API gateway. If the endpoint was internet-exposed, treat the credentials of connected MCP services as possibly exposed and rotate them.

## Timeline

- 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-59822
- 2026-10-23T20:48:43+00:00 analyst — BerriAI advisory GHSA-7488-6r32-c95q: litellm < 1.84.0 affected, fixed in 1.84.0; CISA KEV added 2026-09-02. No public PoC link found. Whether MCP is on by default is not stated in the advisory (unknown).
- 2026-10-23T20:57:53+00:00 analyst — Read GHSA-7488-6r32-c95q: litellm < 1.84.0 affected, fixed in 1.84.0; the advisory page shows no CVE ID, so the CVE-to-GHSA mapping rests on the matching title and fix version. CISA KEV lists it as exploited since 2026-09-02. No public PoC found. Whether MCP is on by default is not stated (unknown).
- 2026-10-23T23:44:52+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-59822

## Documents

- [advisory] GHSA-7488-6r32-c95q MCP Authentication Bypass via OAuth2 Passthrough Fallback https://github.com/BerriAI/litellm/security/advisories/GHSA-7488-6r32-c95q
- [fix] LiteLLM v1.84.0 https://github.com/BerriAI/litellm/releases/tag/v1.84.0

## From the sources

BerriAI LiteLLM contains an improper authentication vulnerability in the MCP Streamable HTTP endpoint that could allow an unauthenticated attacker to establish an authenticated MCP session using an arbitrary Bearer token.

CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_