What Changed
BerriAI’s LiteLLM AI gateway—widely used to proxy OpenAI-compatible and multi-provider LLM traffic—contained an improper authentication flaw in its Model Context Protocol (MCP) Streamable HTTP path. In versions before 1.84.0, a failed LiteLLM API-key check on an Authorization: Bearer … header could fall through an OAuth2-passthrough branch that substituted an empty UserAPIKeyAuth() object instead of failing closed.
The result: an unauthenticated caller with an arbitrary Bearer token could establish an authenticated MCP session and reach configured MCP tooling. CISA added CVE-2026-59822 to KEV on September 2, with a federal remediation deadline of September 16. The 1.84.0 fix gates passthrough on actual target-server OAuth2 configuration and fails closed when servers cannot be resolved or are not in OAuth2 mode.
Why This Matters Operationally
LiteLLM often sits in front of production model keys, tool connectors, and internal MCP servers that can read tickets, query databases, or trigger automations. An empty auth object is not a “read-only preview”—it is a session that subsequent authorization checks treat as validated. AI gateways are becoming the SSO for tool-using agents; failing open on the MCP path turns “any Bearer string” into “call my tools.”
Don’t Miss the Policy Changes That Affect Security Decisions
Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.
Free. Weekday mornings. 5 minutes or less.
Built from 100+ trusted cybersecurity sources.
What Defenders Should Verify First
- Upgrade LiteLLM to 1.84.0 or later everywhere the proxy runs—containers, serverless functions, and laptop-side gateways that still touch production tools.
- Until patched: disable or firewall
/mcproutes and require network authentication in front of the gateway. - Audit MCP access logs for Bearer tokens that never matched a real LiteLLM key, especially around disclosure and KEV dates.
- Rotate LLM provider keys, MCP tool credentials, and any secrets reachable from configured tools if the endpoint was exposed.
- Inventory shadow LiteLLM deployments—data science and application teams stand them up faster than asset lists update.
Source Context
- CISA KEV September 2, 2026 (CVE-2026-59822)
- SentinelOne: LiteLLM auth bypass technical summary
- TechGines: LiteLLM MCP empty-object fallback
- Corgea: MCP Streamable HTTP auth bypass write-up
Upgrade past 1.84.0, lock down /mcp, and assume any exposed gateway minted sessions you did not intend.
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
Free. Weekday mornings. Unsubscribe anytime.
Built from 100+ trusted cybersecurity sources.
