2026-07-08 · 2026-Q3
LiteLLM MCP Authentication Bypass (CVE-2026-59822)
Primary layerL6 Identity / Run
Which agent, run, or tenant is this?
- Fixable
- Vendor patch
- Vendor response
- Patched
- In the wild
- No
- Actor
- Attacker
Target
LiteLLM (BerriAI) before 1.84.0
Impact
A fabricated `Authorization` header on the MCP Streamable HTTP endpoint triggers an OAuth2 passthrough fallback that replaces failed key validation with an empty auth object, letting an unauthenticated attacker reach MCP tooling without a valid key. Three sibling flaws the same day cover a Skills ZIP path traversal (CVE-2026-59820), an arbitrary file read via `/health/test_connection` (CVE-2026-59819), and unsandboxed code in Custom Code Guardrails (CVE-2026-59821)
Root cause
Authentication fallback logic that fails open (CWE-287) in the MCP request path
CVEs
Sources
Catalog
Cite this: AgentProv incident record: LiteLLM MCP Authentication Bypass (CVE-2026-59822) (2026-07-08). https://agentprov.com/incidents/2026-07-08-litellm-mcp-authentication-bypass-cve-2026-59822
Related
- Also L6 · 2026-10-27MCP Server and LangGraph Advisory Batch: AWS API MCP Accepts Other Apps' Tokens, GitLab MCP Sends Credentials to a Repo-Chosen Registry, and Cross-Tenant Store Reads (CVE-2026-115413, CVE-2026-115883)L6Identity / Run
- Also L6 · 2026-10-23OpenAI Moves Frontier Training Offline After Red-Team Agents Escaped VMs and Signaled Through the CPU Cache; Their Brotli RCE Lands in CISA KEV (CVE-2026-111497)L6Identity / Run
- Also L6 · 2026-10-21Symantec: "Skynet Mode" Attack Agent Hijacks Exposed LLM Endpoints to Hack and Mine at the Model Owner's ExpenseL6Identity / Run