CVE-2026-59822: LiteLLM Authentication Bypass in MCP Streamable Endpoint (CVSS 8.2)

Technical summary

The vulnerability resides in LiteLLM's MCP Streamable HTTP endpoint authentication logic. When a LiteLLM API key validation fails, the endpoint was designed with an OAuth2 passthrough fallback. An attacker sending a fabricated Authorization header could trigger this fallback path, which would instantiate an empty UserAPIKeyAuth() object instead of enforcing valid credential verification. This allowed subsequent requests to reach protected MCP (Model Context Protocol) tooling without proper authentication, violating the intended security boundary around API access.

Business impact

Unauthorized access to MCP tooling resources could enable attackers to invoke language model operations, retrieve sensitive data, or manipulate AI-driven workflows without authentication. For organizations using LiteLLM as a central gateway for LLM API orchestration, this bypass exposes all downstream applications and integrations that depend on proper API key enforcement. The impact extends beyond direct API misuse to potential supply-chain style attacks on applications consuming LLM services through the compromised gateway.

Affected systems

LiteLLM versions prior to 1.84.0 are vulnerable. Any deployment using the MCP Streamable HTTP endpoint is at risk. Organizations running LiteLLM as an AI Gateway for internal or multi-tenant LLM access should prioritize immediate assessment of their version and upgrade status. The vulnerability affects the core authentication layer and is not limited to specific deployment patterns or optional configurations.

Exploitability

This vulnerability has a low barrier to exploitation. No special tools, authentication credentials, or user interaction is required—an attacker on the network can craft HTTP requests with a forged Authorization header to trigger the bypass. The attack surface is the public-facing HTTP endpoint, making it remotely exploitable by any unauthenticated attacker with network access to the LiteLLM instance. The simplicity of the attack vector and the high-value nature of LLM gateway access combine to create significant real-world risk.

Remediation

Upgrade LiteLLM to version 1.84.0 or later immediately. This patch corrects the authentication fallback logic to properly validate credentials regardless of header presentation. Organizations should verify the upgrade in a test environment before production deployment to ensure compatibility with existing integrations. If immediate patching is not feasible, restrict network access to the MCP Streamable HTTP endpoint using firewall rules or API gateway policies to limit exposure.

Patch guidance

Deploy LiteLLM 1.84.0 or later. Consult the LiteLLM release notes and vendor advisory to confirm compatibility with your existing configuration, custom integrations, and any downstream applications consuming the MCP Streamable endpoint. Rolling updates should be validated in staging to confirm authentication behavior and endpoint availability post-upgrade. Monitor logs for any authentication-related errors during and after the transition.

Detection guidance

Monitor HTTP access logs for requests to the MCP Streamable endpoint containing Authorization headers paired with unusual or repeated access patterns, particularly from unexpected source IPs. Look for spike in 200 OK responses to MCP endpoint requests that would normally require valid authentication. Implement centralized logging and alerting on failed and successful authentication events at the LiteLLM layer. Network intrusion detection systems (IDS) may flag crafted or malformed Authorization headers if tuned appropriately. Review LiteLLM access logs for any unauthenticated MCP tooling invocations during the vulnerability window.

Why prioritize this

A CVSS 8.2 HIGH severity rating with CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N reflects remote network exploitability requiring no authentication or user interaction. The high confidentiality impact (H) combined with integrity impact (L) and low complexity acknowledge the ease of bypass and the direct threat to sensitive LLM operations. This is an authentication bypass at a critical integration point—LLM gateways are high-value targets. Although not yet on the KEV catalog, the technical profile and real-world attack surface warrant immediate remediation in any organization running LiteLLM in production.

Risk score, explained

The CVSS 8.2 score appropriately reflects the threat model: network-reachable endpoint, no authentication required, no user interaction, and direct compromise of confidentiality (unauthorized LLM API access). The integrity impact acknowledges that attackers could modify requests or invoke unintended operations. The absence of availability impact (N) reflects that the bypass does not directly crash or degrade the service. In context, organizations relying on LiteLLM for multi-tenant or regulated LLM orchestration should treat this as a critical patch priority despite the absence of ransomware history or KEV designation.

Frequently asked questions