LiteLLM fixes critical MCP authentication bypass
A severe authentication vulnerability (CVE-2026-59822) was uncovered in LiteLLM's Model Context Protocol (MCP) Streamable HTTP endpoint, enabling attackers to bypass access controls using fabricated Bearer tokens. Due to a flawed fallback mechanism, failed key verification redirected requests to an OAuth2 passthrough route that instantiated an empty authentication object treated as valid by the server. This allowed unauthenticated remote threat actors to discover and execute configured MCP tools, expose upstream API credentials, and hijack victim AI infrastructure, prompting active exploitation in the wild and immediate addition to CISA's Known Exploited Vulnerabilities catalog prior to being patched in version 1.84.0.
As organizations rush to deploy agentic protocols, AI gateways have become high-value conduits where sloppy authentication defaults transform developer conveniences into wide-open backdoors. Falling back to an empty, implicitly authorized session object when key verification fails is a catastrophic fail-open flaw in mission-critical infrastructure. Granting arbitrary tool execution over MCP allows adversaries to pivot directly into internal corporate data stores, execution runtimes, and proprietary upstream endpoints. The swift addition of this flaw to CISA's KEV catalog shows that automated exploitation campaigns are proactively scanning for and weaponizing AI middleware misconfigurations, requiring self-hosted deployments to immediately update to LiteLLM 1.84.0 or later, audit exposed proxy ports, and cycle any upstream provider keys configured on vulnerable hosts.
DISCOVERED
1h ago
2026-09-11
PUBLISHED
1d ago
2026-09-09
RELEVANCE
AUTHOR
jasonjeske_ai