LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback
HighCVE-2026-59822 · Published Jul 22, 2026 · updated Sep 10, 2026
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| litellm PyPI | < 1.84.0 | 1.84.0 |
Details and references
### Impact LiteLLM's MCP Streamable HTTP endpoint could allow an unauthenticated attacker to establish an authenticated MCP session using an arbitrary Bearer token. The MCP auth handler supported OAuth2 passthrough for upstream MCP servers, but the fallback path could replace failed LiteLLM key validation with an empty `UserAPIKeyAuth()` object. This allowed requests with a fabricated `Authorization` header to reach MCP tooling without a valid LiteLLM key. An attacker could use this to list and call configured MCP tools and access connected services exposed through MCP. ### Patches The issue is fixed in `1.84.0`. We recommend upgrading to `1.84.0` or later. ### Workarounds If upgrading is not immediately possible, disable MCP routes or block access to `/mcp/` and related MCP endpoints at your reverse proxy or API gateway. ### References * [v1.84.0](https://github.com/BerriAI/litellm/releases/tag/v1.84.0)
- CVSS 4.0
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-287
- Also known as
- CVE-2026-59822, PYSEC-2026-3479
More LiteLLM advisories
All LiteLLM| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Jul 22 | LiteLLM: Arbitrary file write via path traversal in Skills archive extraction CVE-2026-59820Mediumfixed in 1.83.7 | Medium | 1.83.7 |
| Jul 22 | LiteLLM: Local file read via request-supplied OIDC file references CVE-2026-59819Lowfixed in 1.83.10 | Low | 1.83.10 |
| Jul 22 | LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks CVE-2026-59821Lowfixed in 1.82.0 | Low | 1.82.0 |
| Jun 21 | BerriAI litellm has SSRF via Unvalidated spec_path URL in MCP OpenAPI Spec Loader CVE-2026-12798Low6.3no fix yet | Low6.3 | No fix yet |
| Jun 21 | BerriAI litellm: UI User Enumeration leads to System-Wide Information Disclosure CVE-2026-12799Low4.3no fix yet | Low4.3 | No fix yet |
| Jun 21 | BerriAI litellm has Security Feature Bypass in BannedKeywords and AzureContentSafety Guardrails via call_type Mismatch on Async Endpoints CVE-2026-12797Low6.3no fix yet | Low6.3 | No fix yet |