LiteLLM CVE-2026-59822: Failed Auth Fell Through to an Empty MCP Session

What Changed

BerriAI’s LiteLLM gateway, used to proxy OpenAI-compatible and multi-provider LLM traffic, contained an improper authentication flaw in its Model Context Protocol (MCP) Streamable HTTP path. In versions before 1.84.0, a failed LiteLLM API-key check on an Authorization: Bearer … header could fall through an OAuth2-passthrough branch that substituted an empty UserAPIKeyAuth() object instead of failing closed.

The result: an unauthenticated caller with an arbitrary Bearer token could establish an authenticated MCP session and reach configured MCP tooling. CISA added CVE-2026-59822 to KEV on September 2, with a federal remediation deadline of September 16. The 1.84.0 fix gates passthrough on actual target-server OAuth2 configuration and fails closed when servers cannot be resolved or are not in OAuth2 mode.

Why This Matters Operationally

LiteLLM often sits in front of production model keys, tool connectors, and internal MCP servers that can read tickets, query databases, or trigger automations. Later authorization checks treat the empty auth object as a validated session. In practice, any Bearer string could reach the MCP tools behind the gateway on versions before 1.84.0.

What Defenders Should Verify First

• Upgrade LiteLLM to 1.84.0 or later everywhere the proxy runs—containers, serverless functions, and laptop-side gateways that still touch production tools.
• Until patched: disable or firewall /mcp routes and require network authentication in front of the gateway.
• Audit MCP access logs for Bearer tokens that never matched a real LiteLLM key, especially around disclosure and KEV dates.
• Rotate LLM provider keys, MCP tool credentials, and any secrets reachable from configured tools if the endpoint was exposed.
• Inventory shadow LiteLLM deployments—data science and application teams stand them up faster than asset lists update.

Source Context

• CISA KEV September 2, 2026 (CVE-2026-59822)
• SentinelOne: LiteLLM auth bypass technical summary
• TechGines: LiteLLM MCP empty-object fallback
• Corgea: MCP Streamable HTTP auth bypass write-up

Upgrade past 1.84.0, lock down /mcp, and assume any exposed gateway minted sessions you did not intend.

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].