CISA Puts LiteLLM's MCP Auth Bypass on Its Exploited List With a Deadline
CISA added CVE-2026-59822, an authentication bypass in the LiteLLM AI gateway, to its Known Exploited Vulnerabilities catalog on September 2, giving federal agencies until September 16 to mitigate. Any unauthenticated attacker can open an MCP session with a fabricated Bearer token. If you run LiteLLM, versions before 1.84.0 are affected: patch or block the MCP endpoint.
On this page
What the flaw allows
LiteLLM, BerriAI's popular open-source gateway that fronts many model providers with one API, has an authentication bypass in its MCP Streamable HTTP endpoint, tracked as CVE-2026-59822. The gateway supports OAuth2 passthrough for upstream MCP servers, and the bug lives in that fallback path: when LiteLLM's own key validation fails, the code improperly substitutes an empty authentication object in place of the rejected context instead of terminating the request. The practical result is that an unauthenticated remote attacker can send any fabricated Bearer token in the Authorization header and receive an authenticated MCP session. [2] [4]
The weakness scores 8.8 out of 10 on the CVSS 4.0 scale, with no privileges, user interaction, or prior access required. The confidentiality impact is rated high because a successful attacker can reach upstream LLM API keys, model outputs, and backend service credentials sitting behind the gateway. [3]
A deadline, and a pattern
CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on September 2, which sets a mitigation deadline of September 16 for US federal agencies under Binding Operational Directive 26-04. KEV listing reflects CISA's assessment of active exploitation risk, and the security firm Ionix says it is tracking ongoing exploitation attempts against exposed instances. [1] [3]
This is also the third LiteLLM entry in the catalog this year. A SQL injection flaw added in May could read and modify the proxy's database, including the credentials it manages, and a command injection flaw added in June let holders of low-privilege internal keys run arbitrary commands on the host. A gateway that concentrates API keys and model traffic is exactly the kind of component that turns one bug into total compromise of an AI stack. [1]
What to do if you run LiteLLM
The fix landed in LiteLLM 1.84.0, which gates the OAuth2 fallback logic properly. Every version before 1.84.0 is affected, so the first step is upgrading and verifying the running version. [2]
If you cannot patch immediately, reduce exposure instead: block external access to the /mcp/ endpoint paths at your reverse proxy or API gateway, or disable MCP routes entirely on internet-exposed instances that do not need them. The exploitation path requires reaching the MCP endpoint, so network-level gating breaks it even on unpatched versions. Then audit for signs of use: unexpected MCP sessions or unfamiliar Bearer tokens in your gateway logs are the pattern to look for. [3]
Why self-hosters should take it seriously
LiteLLM is not niche infrastructure. It is the routing layer inside enterprise AI programs, and AT&T, which now runs 40 percent of employee AI queries on open models, uses LiteLLM model routers to decide which model handles each request. The tool that makes multi-provider AI manageable also concentrates the keys to every provider behind it. [3] [5]
For anyone running local or self-hosted AI, the lesson generalizes beyond one CVE: an MCP server is a remotely reachable service holding powerful credentials, and it deserves the same patching discipline as any database or admin panel. Check whether your stack includes LiteLLM or any MCP endpoint today, because the deadline for federal agencies is September 16 and attackers do not wait for it. [1]
Sources
- Known Exploited Vulnerabilities CatalogCISA
- GHSA-7488-6r32-c95q: LiteLLM authentication bypassBerriAI on GitHub
- CVE-2026-59822: authentication bypass in LiteLLM prior to v1.84.0Ionix
- CVE-2026-59822 detailNIST National Vulnerability Database
- AT&T slashes AI costs by adopting model routers and open sourcePYMNTS