CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
LiteLLM MCP Streamable Endpoint Authentication Bypass Vulnerability (CVE-2026-59822)
[Affected Scope] LiteLLM proxy server and AI Gateway environments running versions prior to 1.84.0
[Impact] Unauthenticated attackers can bypass API key validation using a fabricated Authorization header, gaining unauthorized access to internal MCP tools and LLM APIs.
[Mitigation] Immediately upgrade the LiteLLM package to version 1.84.0 or higher.
LiteLLM Proxy Server MCP Test Endpoints Remote Code Execution Vulnerability Advisory (CVE-2026-42271)
[Affected Scope] LiteLLM proxy server environments running versions 1.74.2 to before 1.83.7
[Impact] Authenticated users with low-privilege API keys can execute arbitrary OS commands on the proxy host, potentially leading to full system compromise
[Mitigation] Immediately upgrade LiteLLM to the patched version 1.83.7 or later, and restrict access to the vulnerable endpoints in the interim
LiteLLM Proxy Server SQL Injection Vulnerability (CVE-2026-42208) Security Advisory
[Affected Scope] LiteLLM proxy server environments running versions from 1.81.16 to before 1.83.7
[Impact] Unauthenticated attackers can read or modify the proxy's database, leading to unauthorized access to the proxy and managed API credentials
[Mitigation] Immediately upgrade LiteLLM to version 1.83.7 or later, and apply WAF rules to block malicious Authorization headers in the interim