LiteLLM auth bypass exploited in the wild (CVE-2026-59822)

Actively exploited in the wild - CVE-2026-59822 is a high-severity authentication bypass in LiteLLM AI Gateway before 1.84.0 that lets unauthenticated attackers reach MCP tooling without a valid key. Patched in version 1.84.0 - update immediately.

Overview

CVE-2026-59822 affects LiteLLM, a widely used proxy server that provides an OpenAI-compatible interface to multiple large language model (LLM) APIs. The vulnerability exists in the MCP (Model Context Protocol) Streamable HTTP endpoint. MCP allows AI models to interact with external tools and data sources.

An attacker can craft a fake Authorization header that triggers an OAuth2 passthrough fallback path. Instead of properly validating the LiteLLM API key, this fallback replaces the failed validation with an empty authorization object, allowing the request to proceed to MCP tooling without authentication.

The vulnerability received a CVSS score of 8.8 (HIGH) with a network attack vector, low attack complexity, no privileges required, and no user interaction needed. The EPSS model predicts only a 0.5% probability of exploitation in the next 30 days, indicating this attack is not widespread, but CISA has confirmed active exploitation in the wild, which demands urgent attention.

Impact

Successful exploitation grants an unauthenticated attacker full access to any MCP tools configured on the LiteLLM proxy. The impact depends on what those tools do:

• Read or modify sensitive data accessible through connected tools
• Execute tool-driven actions such as file operations, database queries, or API calls
• Bypass all authentication and authorization controls intended to restrict model access

Because LiteLLM is often deployed as a central gateway, the blast radius can include downstream systems connected via MCP. Organizations using LiteLLM as an AI gateway should treat this as a critical exposure.

Remediation

Update LiteLLM to version 1.84.0 or later immediately. The fix resolves the authentication bypass in the MCP Streamable HTTP endpoint.

If an immediate upgrade is not possible, restrict network access to the MCP Streamable HTTP endpoint and place it behind a reverse proxy that enforces authentication before requests reach LiteLLM.

Organizations that suspect exposure should audit MCP tool logs for unauthorized access attempts and review activity from IP addresses not associated with legitimate users.

Related data breach reports are available at breach reports and cybersecurity news at security news.

Security Insight

This vulnerability highlights a growing risk in the AI gateway space: authentication fallback paths that silently downgrade security when a primary check fails. The pattern of replacing a failed validation with an empty object rather than rejecting the request is a design flaw that turns a defensive mechanism into an attack surface. As MCP adoption grows, expect attackers to target these integration points where traditional WAF and identity controls do not apply.

Further Reading

• All High Vulnerabilities
• Recent Critical Vulnerabilities
• Top Critical CVEs