LiteLLM is a proxy server

CVE-2026-59822 is an authentication bypass in BerriAI LiteLLM's Model Context Protocol (MCP) Streamable HTTP endpoint. In versions prior to 1.84.0, the MCP auth handler's OAuth2 passthrough fallback path replaces a failed LiteLLM key validation with an empty UserAPIKeyAuth() object. An attacker can send *any* fabricated Authorization: Bearer <garbage> header — even a single character — and be granted a fully authenticated MCP session. From there, the attacker can enumerate and invoke every MCP tool configured on the gateway, access downstream services, exfiltrate LLM provider API keys, and abuse paid model capacity. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms this is unauthenticated, zero-interaction, and network-reachable.

The vendor scored this 8.2 HIGH, which is *conservative* given the real-world picture. CISA added it to KEV on September 2, 2026. Wiz's 90-day honeypot campaign captured active probing of LiteLLM MCP endpoints using single-character tokens, with follow-on activity including credential theft, crypto mining, and blind prompt injection. Censys reports internet-exposed LiteLLM instances nearly doubled in their observation window, with 294,000+ AI/LLM tool IPs now publicly reachable. The trivial exploit, zero prerequisites, confirmed exploitation, and growing attack surface all indicate the vendor score undersells the operational risk. noisgate upgrades this to 8.8.

Why this verdict

• Zero-friction exploit: AV:N/AC:L/PR:N/UI:N — a single curl command with any Bearer token bypasses authentication. No exploit development, no social engineering, no prior access required.
• KEV-listed with confirmed campaigns: CISA added this on 2026-09-02. Wiz honeypots captured active exploitation including credential theft, crypto mining, and prompt injection. This is not theoretical.
• Growing attack surface: Censys shows internet-exposed LiteLLM instances nearly doubled, with 294,000+ AI/LLM tool IPs publicly reachable. The target population is large and expanding.
• Role multiplier: LiteLLM is an AI Gateway that centralizes LLM provider API keys (OpenAI, Anthropic, Azure, etc.) and connects to MCP tools with potentially broad downstream access (databases, filesystems, code execution). In enterprises, it functions as a credential aggregator and service broker. Compromise yields API key exfiltration (financial impact via model abuse), data access through MCP tools, and potential lateral movement to downstream systems. The blast radius is host → tenant → potentially supply-chain depending on MCP tool scope. While not a canonical DC/hypervisor, the credential-aggregation role and growing deployment footprint place this firmly in the HIGH floor.
• Chainability: CVE-2026-42271 demonstrates that LiteLLM MCP test endpoints can be chained for full RCE (subprocess spawning). This auth bypass is the front door for that chain.

Why not higher?

This stops short of CRITICAL because LiteLLM is not a canonical identity-tier or fleet-management component — it does not directly control domain trust, hypervisor layers, or host-level security agents. The blast radius is bounded by what MCP tools are configured; a deployment with no MCP tools or read-only tools limits impact to API key exposure and capacity abuse. The integrity impact is rated LOW in the CVSS vector, reflecting that direct data modification is limited without chaining.

Why not lower?

KEV listing with confirmed active exploitation campaigns immediately eliminates any downgrade below HIGH. The attack requires zero authentication, zero complexity, and zero user interaction against a network-reachable service with a rapidly growing internet-exposed population. The credential-aggregation role (LLM provider API keys worth thousands of dollars monthly) and downstream MCP tool access ensure material business impact even in baseline deployments.

1. Block /mcp/ paths at your reverse proxy or API gateway immediately — The GHSA advisory explicitly recommends this as the interim workaround. Add a deny rule for all paths matching /mcp/* at your load balancer, WAF, or reverse proxy (nginx, Envoy, Cloudflare, etc.). Deploy within the noisgate mitigation SLA of ≤3 days given KEV status overrides to 'immediately'.
2. Restrict LiteLLM to internal networks only — LiteLLM should never be directly internet-facing. Place it behind a VPN, zero-trust proxy, or private network segment. If it must be reachable externally, enforce mutual TLS or IP allowlisting at the network edge. This eliminates the AV:N vector entirely.
3. Rotate all LLM provider API keys — Assume any API keys configured in exposed LiteLLM instances are compromised. Rotate OpenAI, Anthropic, Azure, and all other provider keys. Set per-key spend limits and IP restrictions on the provider side to bound financial blast radius.
4. Audit MCP tool configurations for least privilege — Review every MCP tool registered in your LiteLLM deployment. Remove test endpoints (which enabled RCE via CVE-2026-42271). Restrict remaining tools to read-only or narrowly-scoped operations. This limits blast radius even if auth bypass recurs.
5. Deploy WAF rules to validate Bearer tokens — Configure your WAF to reject requests to LiteLLM endpoints where the Bearer token does not match expected format (e.g., minimum length, known prefix). This catches the single-character token probing observed in the wild.

Run this script on any host with curl and network access to the target LiteLLM instance. Invoke as: bash check_cve_2026_59822.sh https://litellm.example.com:4000. No special privileges required — it performs a non-destructive read-only probe of the MCP endpoint.

#!/usr/bin/env bash
# check_cve_2026_59822.sh — Detect CVE-2026-59822 LiteLLM MCP Auth Bypass
# Usage: bash check_cve_2026_59822.sh <LITELLM_BASE_URL>
# Exit codes: 0=VULNERABLE, 1=PATCHED, 2=UNKNOWN

set -euo pipefail

if [ -z "${1:-}" ]; then
  echo "Usage: $0 <LITELLM_BASE_URL>"
  echo "Example: $0 https://litellm.example.com:4000"
  exit 2
fi

BASE_URL="${1%/}"
MCP_ENDPOINT="${BASE_URL}/mcp"

echo "[*] Probing LiteLLM MCP endpoint at ${MCP_ENDPOINT}"
echo "[*] Sending fabricated Bearer token (non-destructive tools/list only)..."

# Send MCP initialize request with a dummy Bearer token
HTTP_CODE=$(curl -s -o /tmp/cve_2026_59822_response.json -w "%{http_code}" \
  -X POST "${MCP_ENDPOINT}" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer noisgate-probe-cve2026" \
  -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-03-26","capabilities":{},"clientInfo":{"name":"noisgate-scanner","version":"1.0.0"}}}' \
  --connect-timeout 10 --max-time 15 2>/dev/null) || true

RESPONSE=$(cat /tmp/cve_2026_59822_response.json 2>/dev/null || echo "")
rm -f /tmp/cve_2026_59822_response.json

echo "[*] HTTP response code: ${HTTP_CODE}"

if [ -z "${HTTP_CODE}" ] || [ "${HTTP_CODE}" = "000" ]; then
  echo "UNKNOWN — Could not connect to ${MCP_ENDPOINT}"
  exit 2
fi

# Check if we got a successful MCP session with the fake token
if [ "${HTTP_CODE}" = "200" ] && echo "${RESPONSE}" | grep -qi '"protocolVersion"'; then
  echo "VULNERABLE — MCP session established with fabricated Bearer token."
  echo "[!] CVE-2026-59822: Auth bypass confirmed. Upgrade to LiteLLM >= 1.84.0 immediately."
  echo "[*] Server response (truncated): $(echo "${RESPONSE}" | head -c 500)"
  exit 0
elif [ "${HTTP_CODE}" = "401" ] || [ "${HTTP_CODE}" = "403" ]; then
  echo "PATCHED — MCP endpoint rejected fabricated Bearer token (HTTP ${HTTP_CODE})."
  exit 1
elif [ "${HTTP_CODE}" = "404" ]; then
  echo "PATCHED — MCP endpoint not found (feature may be disabled or path blocked)."
  exit 1
else
  echo "UNKNOWN — Unexpected HTTP ${HTTP_CODE}. Manual review recommended."
  echo "[*] Response: $(echo "${RESPONSE}" | head -c 300)"
  exit 2
fi

Sources

1. CISA KEV Addition Alert (2026-09-02)
2. GitHub Security Advisory GHSA-7488-6r32-c95q
3. The Hacker News — CISA Adds Seven Exploited Flaws
4. eSecurity Planet — Wiz Finds Active LiteLLM and MCP Attacks
5. Censys — AI/LLM Tool Exposures Up 60%
6. GitLab Advisory Database — CVE-2026-59822
7. NVD — CVE-2026-59822 Detail
8. Obsidian Security — Breaking LiteLLM