CVE-2026-59822LiteLLM MCP gateway accepts any Bearer token after key validation fails
What broke
LiteLLM is a proxy that sits between applications and LLM providers, and it can also front MCP tool servers. Its MCP auth handler supports OAuth2 passthrough so a client's token can be forwarded to an upstream MCP server. BerriAI's advisory, published June 30, 2026, says that when LiteLLM key validation failed, the fallback path substituted an empty UserAPIKeyAuth() object instead of rejecting the request. A request with a fabricated Authorization header could then "list and call configured MCP tools" on the Streamable HTTP endpoint without a valid LiteLLM key. Versions before 1.84.0 are affected. NVD scores it CVSS 3.1 8.2 and lists CWE-287 and CWE-306.
Wiz reported on August 27, 2026 that its honeypots recorded the flaw being used with single-character tokens such as x. The same report describes attackers on LiteLLM honeypots pulling the master key from process memory, reading /app/litellm_config.yaml and /etc/litellm/.env, and trying the default master key sk-1234, though it does not tie those steps to this CVE specifically. CISA added it to KEV on September 2, 2026.
Why it matters
An AI gateway is a credential broker. It holds provider API keys and connections to internal services through MCP, and its own key is the only thing deciding who may use them. Here a failed check produced an identity instead of a refusal: any caller became a user with an empty, unscoped principal. A fallback that grants access on error is the same mistake as alg: none in a JWT verifier. MCP authorization expects the server to validate every bearer token it accepts, not to assume a downstream server will.
What to do
- Upgrade LiteLLM to 1.84.0 or later.
- Until then, disable MCP routes or block
/mcp/and related MCP endpoints at a reverse proxy or API gateway, as the advisory recommends. - Keep the proxy off the internet unless it must be public, and never run with the default master key.
After you patch
- Rotate the LiteLLM master key and every provider API key the proxy stores, plus credentials of services exposed as MCP tools.
- Review proxy logs for MCP calls and
GET /v1/modelsrequests with very short or malformed Bearer tokens.
Sources
Related on Start with Identity
- CVECheck Point Remote Access VPN lets attackers in without a password over IKEv1
A certificate validation logic flaw in Check Point Remote Access and Mobile Access over deprecated IKEv1 let attackers open a VPN session without a valid passwo
- CVECheck Point SmartConsole login hands an unauthenticated attacker an admin token
A flaw in the Check Point SmartConsole login process let an unauthenticated attacker obtain an application login token and sign in to the Management Server as a
- CVECommvault Web Server zero-day that exposed Metallic Microsoft 365 app secrets
An authenticated webshell flaw in Commvault Web Server, used as a zero-day in Commvault's Azure environment, where the actor may have reached client secrets cus
- BlogLiteLLM traces its poisoned release to an admin key leaked in May and never revoked
LiteLLM's October 23 attack-chain report says an Agent Platform admin key committed to a public repo on May 27 was deleted but never revoked. On October 10 it r
- BlogNearly one in ten exposed LiteLLM gateways still accept the documentation's example admin key
Wiz found 3,074 internet-facing LiteLLM gateways, of which 294 accepted sk-1234, the key printed in the setup docs. In 191 of those no key was set at all, which
- BlogPoisoned LiteLLM 1.107.0 shipped a credential stealer to PyPI and Docker for under three hours
LiteLLM said on October 21 that attackers published a malicious litellm 1.107.0 to PyPI, Docker Hub and GHCR, built from a lookalike Berri-AI/litellm repository