LiteLLM MCP Streamable Endpoint Authentication Bypass Vulnerability (CVE-2026-59822)

1. Apply Official Patch (Recommended)

The primary remediation is to upgrade LiteLLM to version 1.84.0 or later.

# For pip-based installations
pip install --upgrade litellm>=1.84.0

# For Docker deployments, update your image tag in Dockerfile or docker-compose.yml
# image: ghcr.io/berriai/litellm:v1.84.0

2. Temporary Mitigations

If an immediate upgrade is not feasible, implement the following workarounds:

• WAF Rules: Configure Web Application Firewall (WAF) rules to inspect and block anomalous Authorization headers targeting MCP-related endpoints.
• Network Segmentation: Restrict access to the LiteLLM proxy and MCP endpoints to trusted internal networks (VPC, VPN) and avoid exposing them directly to the public internet.

LiteLLM is an AI gateway and proxy server designed to streamline LLM API calls. This vulnerability (CVE-2026-59822) represents a critical authentication bypass flaw within LiteLLM's MCP (Model Context Protocol) Streamable HTTP endpoint.

Root Cause Analysis (CWE-287, CWE-306)

When an attacker sends a request containing a fabricated Authorization header, it triggers an OAuth2 passthrough fallback path within the application. Instead of rejecting the request upon failed LiteLLM key validation, the fallback mechanism erroneously replaces the failed validation with an empty UserAPIKeyAuth() object. This allows the request to bypass security checks and reach sensitive MCP tooling without a valid API key.

Exploitability and Impact

With a CVSS score of 8.2 (High) and its inclusion in the CISA Known Exploited Vulnerabilities (KEV) catalog, this vulnerability is actively being exploited in the wild. An external attacker can easily exploit this flaw via a single crafted HTTP request to gain unauthorized access to downstream LLM integrations and internal agent tools.