identity-authentication-vulnerabilitywidely-deployed-product-advisoryai-platform-securityinternet-facing-service-vulnerability

LiteLLM MCP Endpoint Authentication Bypass Fixed in v1.84.0

Vulnerability Disclosure · 2 sources · Updated 4mo ago · First seen Jul 8, 2026

BerriAI disclosed and fixed CVE-2026-59822, an authentication bypass in LiteLLM versions prior to 1.84.0 that exposed the MCP Streamable HTTP endpoint to unauthenticated access. The flaw allowed a remote attacker to send a fabricated Authorization header that triggered an OAuth2 passthrough fallback path; when LiteLLM key validation failed, the application substituted an empty UserAPIKeyAuth() object and still allowed requests to reach MCP tooling. The vulnerability is classified under CWE-287 and CWE-306 and is described as network-exploitable without privileges or user interaction.

The fix shipped in LiteLLM v1.84.0, alongside broader security hardening across authentication, authorization, and MCP-related features. Release notes for v1.84.0 also highlight encrypted MCP credentials at rest, SSRF protections for OAuth metadata discovery follow-up fetches, hardened invite-link onboarding token handling, redaction of sensitive data, and signed Docker images that can be verified with cosign using a pinned public key and commit reference. Organizations running LiteLLM should upgrade to 1.84.0 or later and validate deployment artifacts as part of remediation.

Do you run this?See affected versions and whether adversaries are exploiting it.

Check your exposure

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

2 events · May 14, 2026 – Jul 8, 2026

Jul 8, 20264mo ago
CVE-2026-59822 is published for LiteLLM authentication bypass
CVE-2026-59822 was newly published describing an authentication bypass in LiteLLM versions prior to 1.84.0. The flaw affects the MCP Streamable HTTP endpoint, where a fabricated Authorization header can trigger an OAuth2 passthrough fallback that allows access without a valid LiteLLM key.
CVE-2026-59822 - LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback
May 14, 20266mo ago
BerriAI releases LiteLLM v1.84.0 with security hardening
BerriAI published LiteLLM version 1.84.0, whose release notes include multiple security-related changes and hardening updates affecting authentication, authorization, MCP handling, and related protections. The CVE reference states that this version fixes CVE-2026-59822.
Release v1.84.0 · BerriAI/litellm · GitHub

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Vulnerabilities

1 linked

Authentication Bypass in LiteLLM MCP Streamable HTTP (CVE-2026-59822)

Affected products

1 linked

Litellm

Organizations

1 linked

BerriAI

Do you run this?See whether adversaries are exploiting this yet, and where the affected versions run in your environment.

Check Your Exposure

Source coverage

Sources

2 references tracked. Mallory keeps watching after this page renders.

Cvefeed High SeverityAdvisories · Jul 8, 2026

CVE-2026-59822 - LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough FallbackOpen source ↗

Github WebNews · May 14, 2026

Release v1.84.0 · BerriAI/litellm · GitHubOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

LiteLLM MCP Endpoint Authentication Bypass Fixed in v1.84.0

How this story unfolded

CVE-2026-59822 is published for LiteLLM authentication bypass

BerriAI releases LiteLLM v1.84.0 with security hardening

Related entities

Vulnerabilities

Affected products

Organizations

Sources

See the full picture, correlated to your attack surface.

Related stories

LiteLLM Flaws Enable Privilege Escalation and OIDC Authentication Bypass

LiteLLM Authorization Flaw Enables Secret Theft and Admin Takeover; Probing Follows Disclosure

LiteLLM Flaws Enable Gateway Takeover, Remote Code Execution and API-Key Theft

LiteLLM MCP Endpoint Authentication Bypass Fixed in v1.84.0

How this story unfolded

CVE-2026-59822 is published for LiteLLM authentication bypass

BerriAI releases LiteLLM v1.84.0 with security hardening

Related entities

Vulnerabilities

Affected products

Organizations

Sources

See the full picture, correlated to your attack surface.

Related stories

LiteLLM Flaws Enable Privilege Escalation and OIDC Authentication Bypass

LiteLLM Authorization Flaw Enables Secret Theft and Admin Takeover; Probing Follows Disclosure

LiteLLM Flaws Enable Gateway Takeover, Remote Code Execution and API-Key Theft