CVE-2026-59822

Name of the Vulnerable Software and Affected Versions LiteLLM versions prior to 1.84.0

Description LiteLLM is a proxy server (AI Gateway) used to call LLM APIs. The MCP Streamable HTTP endpoint contains an authentication bypass where an unauthenticated attacker can use a fabricated Authorization header to trigger an OAuth2 passthrough fallback path. This process replaces failed key validation with an empty UserAPIKeyAuth() object, allowing requests to reach Model Context Protocol (MCP) tooling without a valid key. This allows attackers to establish authenticated MCP sessions, list and call configured tools, and access connected services such as databases, files, and internal APIs. Real-world exploitation has been observed, including the use of single-character tokens to run crypto miners and perform blind prompt injection against agents behind the MCP server.

Recommendations Update LiteLLM to version 1.84.0 or later. As a temporary workaround, disable MCP routes or block access to the /mcp/ endpoint and related MCP endpoints at the reverse proxy or WAF. If the gateway was internet-facing, rotate every API key and secret held by the gateway.