Loading vulnerability…
Authentication Bypass in LiteLLM MCP Streamable HTTP
CVE-2026-59822 is an authentication-bypass vulnerability in BerriAI LiteLLM versions earlier than 1.84.0. The MCP Streamable HTTP authentication handler incorrectly invokes an OAuth2 passthrough fallback when LiteLLM API-key validation fails with an HTTP 401 or 403 response. Instead of rejecting the request, it creates an empty UserAPIKeyAuth() object, allowing an unauthenticated attacker supplying an arbitrary Bearer token, including a single-character token, to establish an authenticated MCP session. Accessible tools and connected services depend on the deployment's MCP configuration. Version 1.84.0 fixes the vulnerability. Exploitation has been observed in honeypots, and the vulnerability is included in CISA's Known Exploited Vulnerabilities catalog.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An unauthenticated remote attacker can bypass LiteLLM API-key validation and enumerate or invoke accessible MCP tools. Depending on configured integrations and their permissions, this can expose sensitive information in databases, repositories, file systems, and connected services, or permit unauthorized workflow operations and data modification. The assessed impact is high for confidentiality and low for integrity, with no direct availability impact identified. The bypass alone does not confer LiteLLM administrator privileges or establish arbitrary host code execution.
If you can’t patch tonight, do this now.
If upgrading is not immediately possible, disable MCP routes or block access to MCP endpoints at the reverse proxy or API gateway. Restrict endpoint access to trusted clients, limit which users and keys can access each MCP server, and avoid broadly permissive tool access. Apply least-privilege permissions to connected services and workload identities, and restrict outbound connectivity to reduce potential impact.
Patch, then assume compromise.
Upgrade affected LiteLLM deployments to version 1.84.0 or a later trusted, patched release. Include older containers and test deployments in the upgrade scope. If unauthorized access is suspected, investigate MCP activity and rotate credentials potentially exposed through accessible tools or connected services.
No validated public exploits yet. Hidden: 1 rejected by Mallory's analysis as not a working exploit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
51 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.