CVE-2026-59822

LiteLLM MCP OAuth fallback bypasses authentication

BerriAI · LiteLLM MCP

First documented disclosure · Review checkpoint

Summary

A fabricated bearer token could reach configured MCP tools without a valid LiteLLM key.

Severity and exploitation evidence

High · 8.8/10 · CVSS 4.0. Severity source.

Reported activity: CISA lists this CVE in its Known Exploited Vulnerabilities catalog, added 2026-09-02. The catalog does not establish victim counts or exploitation of every affected deployment.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

An OAuth passthrough fallback replaced failed authentication with an empty authorization object.

Conditions required

Network access to the vulnerable MCP Streamable HTTP routes.

Potential impact

Unauthorized tool calls and access to connected services.

Affected versions and configurations

Before 1.84.0.

Fix and mitigation status

1.84.0.

Practical next steps

Upgrade; if delayed, disable or block MCP endpoints and investigate prior unauthorized tool access.

Operating lesson

An authentication failure must remain a failure across every connector fallback.

Evidence and limits

June 30 is the upstream publication date; July 8 is the CVE publication. KEV confirms known exploitation but does not provide victim counts or a campaign narrative.

Sources