CVE-2026-59822

What is LiteLLM?

LiteLLM (by BerriAI) is a widely deployed open-source AI gateway: a proxy server that gives applications a single OpenAI-compatible API in front of 100+ LLM providers, handling API-key management, spend tracking, rate limiting, and — relevant here — Model Context Protocol (MCP) integration that exposes tools to LLM agents. Because a LiteLLM proxy holds provider API keys and brokers access to internal MCP tool servers, compromising it hands an attacker both paid LLM capacity and a pivot into whatever internal services the MCP tools can reach.

Overview

CVE-2026-59822 is an authentication bypass (CWE-287) in LiteLLM's MCP Streamable HTTP endpoint: an unauthenticated attacker can establish a fully authenticated MCP session by presenting any arbitrary Bearer token. It was exploited in the wild as part of a broader 2026 campaign against AI infrastructure and was added to the CISA KEV catalog on 2026-09-02, in the same seven-CVE batch as the related Starlette flaw (CVE-2026-48710) and Kestra (CVE-2026-49869).

Affected Versions

Technical Details

LiteLLM's MCP authentication handler supports OAuth2 passthrough so that client tokens can be forwarded to upstream MCP servers. The bug sits in the failure path: when validation of a LiteLLM virtual key failed, the handler fell back to constructing an empty UserAPIKeyAuth() object instead of rejecting the request — effectively treating "invalid credentials" as "anonymous but authenticated." Any fabricated Authorization: Bearer <anything> header therefore yields a working MCP session.

From that session an attacker can list and invoke every MCP tool configured on the proxy and reach downstream services exposed through those tools. The attack is a single unauthenticated HTTP request with low complexity. The fix (commit 73869f0, PR #26463, shipped in 1.84.0) makes failed key validation terminal.

Note on scoring: the GitHub/GitLab advisory data lists CVSS 8.2 (the NVD value used here); some press coverage cited 8.8.

Discovery

Disclosed through LiteLLM's GitHub security advisory GHSA-7488-6r32-c95q. In-the-wild exploitation was surfaced by Wiz researchers via their AI-infrastructure honeypot telemetry.

Exploitation Context

Wiz observed attackers probing LiteLLM model-enumeration endpoints and establishing MCP sessions with arbitrary Bearer tokens — part of a sustained 2026 wave of attacks on AI infrastructure that also exploited the LiteLLM MCP command-injection flaw CVE-2026-42271 (KEV'd 2026-06-09, exploited since June 2026 and linked to Qilin/Agenda-associated actors deploying XMRig coinminers). LiteLLM proxies are attractive targets both for LLM-capacity theft ("LLMjacking") and as a bridge into internal tool infrastructure. No exposure counts have been published for this specific CVE.

Remediation

1. Upgrade LiteLLM to 1.84.0 or later. Federal agencies must remediate by 2026-09-16 under BOD 22-01.
2. If you cannot upgrade immediately, block unauthenticated access to the MCP endpoints (/mcp routes) at a reverse proxy or network layer.
3. Avoid exposing LiteLLM proxies directly to the internet; front them with an authenticating gateway or VPN.
4. Hunt for abuse: review proxy logs for MCP session establishment with unknown/garbage Bearer tokens, unexpected tool listing/invocation, and spikes in provider spend; rotate provider API keys held by any proxy that was exposed while vulnerable.
5. Audit which MCP tools the proxy exposes and apply least privilege — a compromised gateway should not be able to reach sensitive internal services.