Which versions of LiteLLM are affected by CVE-2026-59822?

An authentication bypass vulnerability in LiteLLM AI gateway before version 1.84.0 allows unauthenticated remote attackers to access MCP tooling and underlying AI services by exploiting a malformed…. A patch is available.

Is there a public PoC exploit available for CVE-2026-59822?

Yes, a public proof-of-concept exploit is available for CVE-2026-59822. Prioritise patching immediately. EPSS: 0.3%.

How to fix or mitigate CVE-2026-59822?

Within 24 hours: Identify all systems running LiteLLM and verify versions below 1.84.0; implement WAF rules to reject malformed Authorization headers; enable detailed logging of all authentication failures and anomalies. Within 7 days: Deploy network segmentation to restrict LiteLLM access to trusted internal networks only; deploy upstream API authentication middleware as a compensating control; audit API access logs for exploitation indicators (malformed auth headers, unexpected MCP tool access). Within 30 days: Monitor vendor communications for official release of LiteLLM 1.84.0 or later; plan and execute upgrade; conduct post-patch security testing and access log review.

LiteLLM CVE-2026-59822

Q: What is the CVSS score of CVE-2026-59822?

CVE-2026-59822 has a CVSS 4.0 base score of 8.8 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-42359 HIGH

Improper Authentication (CWE-287)

2026-07-08 GitHub_M

GHSA-7488-6r32-c95q

Authentication Bypass Litellm Berriai

8.8

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.8 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.2 HIGH

Network-reachable MCP endpoint, no key or user interaction needed (AV:N/AC:L/PR:N/UI:N); bypass exposes MCP tooling (C:H) with limited integrity effect (I:L) and no availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Added to CISA KEV

Sep 02, 2026 - 17:02 CISA

Patch available

Jul 08, 2026 - 21:04 EUVD

Analysis Generated

Jul 08, 2026 - 20:30 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

13 pypi packages depend on litellm (11 direct, 2 indirect)

Ecosystem-wide dependent count for version 1.84.0.

DescriptionCVE.org

LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.84.0, LiteLLM's MCP Streamable HTTP endpoint allowed an unauthenticated attacker to use a fabricated Authorization header to trigger an OAuth2 passthrough fallback path that replaced failed LiteLLM key validation with an empty UserAPIKeyAuth() object, allowing requests to reach MCP tooling without a valid LiteLLM key. This issue is fixed in version 1.84.0.

Articles & Coverage 1

POC CVE-2026-59822: Proof-of-Concept Repository (Details Pending) Sep 03, 2026

AnalysisAI

Authentication bypass in LiteLLM (BerriAI) proxy/AI Gateway before 1.84.0 lets a remote unauthenticated attacker reach MCP tooling by sending a fabricated Authorization header. The malformed header forces the MCP Streamable HTTP endpoint down an OAuth2 passthrough fallback that substitutes a failed key validation with an empty UserAPIKeyAuth() object, effectively treating the caller as authorized without any valid LiteLLM key. The CVSS 4.0 score of 8.8 reflects network-reachable, no-privilege access with high confidentiality impact; no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

LiteLLM is a widely used open-source proxy that normalizes calls to many LLM providers behind an OpenAI-compatible API, and it exposes a Model Context Protocol (MCP) Streamable HTTP endpoint to broker access to MCP tools/servers. The flaw is a CWE-287 (Improper Authentication) defect in the request auth path: when LiteLLM key validation fails, an OAuth2 passthrough fallback branch was intended for legitimate upstream OAuth flows, but it did not fail closed. Instead of rejecting the request, the code returned an empty UserAPIKeyAuth() object - a default/anonymous auth context - allowing the pipeline to continue as though a valid key had been presented. The affected component is the MCP Streamable HTTP handler in cpe:2.3:a:berriai:litellm, and the fix (PR #26463 / commit 73869f0) ensures a fabricated or invalid Authorization header no longer collapses into an authenticated-empty state.

RemediationAI

Vendor-released patch: 1.84.0 - upgrade LiteLLM to 1.84.0 or later, which corrects the OAuth2 passthrough fallback so failed key validation no longer yields an empty authenticated context (see PR https://github.com/BerriAI/litellm/pull/26463 and commit https://github.com/BerriAI/litellm/commit/73869f0faf7d11ee21adcb5f91b8c33a340b6c2c, advisory https://github.com/BerriAI/litellm/security/advisories/GHSA-7488-6r32-c95q). If immediate upgrade is not possible, reduce exposure by placing the LiteLLM MCP Streamable HTTP endpoint behind a network boundary or authenticating reverse proxy so only trusted callers can reach it, and by disabling the MCP integration if it is not in use - the trade-off is loss of MCP tool functionality for clients. Where the OAuth2 passthrough path is not required, disabling it removes the vulnerable branch entirely at the cost of breaking legitimate OAuth passthrough flows. Monitor MCP endpoint access logs for requests bearing malformed or unexpected Authorization headers that still succeed.