CVE-2026-59822: LiteLLM MCP Streamable HTTP Auth Bypass (KEV)

CVE-2026-59822 is an authentication-bypass flaw in LiteLLM's Model Context Protocol (MCP) Streamable HTTP endpoint that lets an unauthenticated attacker send a fabricated Authorization header and reach the LLM gateway's connected MCP tools and services without a valid key, and it is now on the CISA KEV catalog as actively exploited — an early, concrete example of MCP-server access control failing in a widely deployed AI gateway.

CVE-2026-59822 is an Improper Authentication (CWE-287) combined with a Missing Authentication for Critical Function (CWE-306) issue in LiteLLM, an open-source proxy server ("AI Gateway") that fronts LLM APIs in an OpenAI-compatible format. NVD's Analyzed description states that prior to version 1.84.0, "LiteLLM's MCP Streamable HTTP endpoint allowed an unauthenticated attacker to use a fabricated Authorization header to trigger an OAuth2 passthrough fallback path that replaced failed LiteLLM key validation with an empty UserAPIKeyAuth() object, allowing requests to reach MCP tooling without a valid LiteLLM key" (NVD).

NVD has published its own independent Primary score: CVSS v3.1 8.2 (high), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N — network-reachable, no authentication or user interaction required, high confidentiality impact. A separate GitHub-submitted CVSS v4.0 Secondary score of 8.8 is also on file (NVD).

The GitHub Security Advisory for this issue (GHSA-7488-6r32-c95q) confirms the fix ships in LiteLLM 1.84.0, credits researcher "yaaras" for the report, and states that an attacker exploiting this flaw could "list and call configured MCP tools and access connected services exposed through MCP" with no valid credentials. For deployments that cannot upgrade immediately, the advisory's workaround is to disable MCP routes or restrict access to /mcp/ endpoints at a reverse proxy or API gateway (GitHub Security Advisory GHSA-7488-6r32-c95q).

CISA added CVE-2026-59822 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-09-02, with a required-action due date of 2026-09-16, naming the flaw the "BerriAI LiteLLM Improper Authentication Vulnerability" and describing it as allowing an attacker to "establish an authenticated MCP session using an arbitrary Bearer token" (CISA KEV).

As of 2026-10-27, FIRST scores the probability of exploitation at 0.0084 (57.523th percentile) — modest compared with the network appliance CVEs typically seen on KEV, consistent with a developer-facing AI-gateway tool rather than a mass-scanned edge device, though its presence on KEV at all confirms real exploitation attempts against exposed LiteLLM MCP endpoints (FIRST EPSS).

Any organization running a self-hosted LiteLLM gateway with MCP tools configured should upgrade to 1.84.0 or later immediately; if that is not possible, restrict or disable the /mcp/ routes at the reverse proxy until the upgrade can happen, since a fabricated bearer token is enough to reach whatever internal tools or services the gateway exposes through MCP.

• LiteLLM before 1.84.0 allowed an unauthenticated attacker with a fabricated Authorization header to trigger an OAuth2 passthrough fallback that replaced failed key validation with an empty auth object, reaching MCP tooling without a valid key. — NVD
• CVSS v3.1 base score is 8.2 (high), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N — NVD's own Primary score (a separate GitHub-submitted v4.0 Secondary score of 8.8 is also on file). — NVD
• Fixed in LiteLLM 1.84.0; an attacker exploiting the flaw could list and call configured MCP tools and reach services exposed through MCP with no valid credentials; workaround is disabling or restricting the /mcp/ routes at a reverse proxy. — GitHub Security Advisory GHSA-7488-6r32-c95q
• Added to the CISA Known Exploited Vulnerabilities catalog on 2026-09-02, required-action due date 2026-09-16, described as allowing an attacker to establish an authenticated MCP session using an arbitrary Bearer token. — CISA KEV
• EPSS score is 0.0084 (57.523th percentile) as of 2026-10-27. — FIRST EPSS