Actively exploited · Published Jul 8, 2026 · Assigned by GitHub_M

CVE-2026-59822LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback

High 8.8 Exploited

In plain English

A high-severity improper authentication in litellm from BerriAI. Attackers are actively exploiting it in the wild (listed by CISA on September 2, 2026). The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 58% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)8.8High

Exploit odds (30 days)0.8%top 42.1% of all CVEs

Exploited in the wildYesCISA KEV since Sep 2, 2026

Attack tooling1Public PoC

CISA guidance

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Federal agencies must remediate by Sep 16, 2026.

Official description

LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.84.0, LiteLLM's MCP Streamable HTTP endpoint allowed an unauthenticated attacker to use a fabricated Authorization header to trigger an OAuth2 passthrough fallback path that replaced failed LiteLLM key validation with an empty UserAPIKeyAuth() object, allowing requests to reach MCP tooling without a valid LiteLLM key. This issue is fixed in version 1.84.0.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
PyPI	litellm	1.84.0	GHSA-7488-6r32-c95q
PyPI	litellm	1.84.0	PYSEC-2026-3479

Affected products (as reported)

Vendor	Product	Versions
BerriAI	litellm	< 1.84.0

Weakness: CWE-287, CWE-306 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

References

https://github.com/BerriAI/litellm/security/advisories/GHSA-7488-6r32-c95q x_refsource_CONFIRM
https://github.com/BerriAI/litellm/pull/26463 x_refsource_MISC
https://github.com/BerriAI/litellm/commit/73869f0faf7d11ee21adcb5f91b8c33a340b6c2c x_refsource_MISC
https://github.com/BerriAI/litellm/releases/tag/v1.84.0 x_refsource_MISC
https://www.wiz.io/blog/ai-infrastructure-honeypot third-party-advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-59822 government-resource