Which LiteLLM versions are affected by CVE-2026-59822?

The GitHub-reviewed advisory lists LiteLLM versions before 1.84.0 as affected. Version 1.84.0 contains the fix for the MCP authentication bypass.

What does CVE-2026-59822 affect?

The flaw affects LiteLLM's MCP Streamable HTTP authentication path. A failed LiteLLM credential check could fall through to OAuth2 passthrough logic and create an empty authentication object instead of rejecting the request.

Is patching LiteLLM enough after exposure?

Patching closes the vulnerable code path, but an internet-reachable deployment should also review access logs, MCP server permissions and downstream credentials. Rotate credentials that could have been exposed if unauthorized MCP sessions cannot be ruled out.

What should operators do if they cannot upgrade immediately?

The vendor advisory recommends disabling MCP routes or blocking access to /mcp/ and related MCP endpoints at the reverse proxy or API gateway until the deployment can be upgraded.

Editorial

Security brief · MCP operations · 13 September 2026

LiteLLM MCP auth bypass CVE-2026-59822: patch and verify exposure

CVE-2026-59822 is a high-severity authentication bypass in LiteLLM's MCP Streamable HTTP path. The vendor's reviewed advisory says versions before 1.84.0 can allow a fabricated bearer credential to reach MCP handling because a failed LiteLLM key check falls through to an OAuth2 passthrough path instead of failing closed. CISA added the vulnerability to its Known Exploited Vulnerabilities catalogue on 2 September 2026, making this an exposure-and-remediation problem rather than a theoretical protocol concern.

Published 13 September 2026 · sources checked 13 September 2026

< 1.84.0

affected LiteLLM versions in the reviewed advisory

1.84.0+

vendor-fixed line for this authentication bypass

16 Sep 2026

CISA KEV remediation due date for U.S. federal civilian agencies

What broke

An authentication failure became a permissive fallback

LiteLLM supports OAuth2 passthrough for MCP servers that authenticate against an upstream authorization system. In the affected path, a request carrying an Authorization header could fail LiteLLM's own key validation with a 401 or 403 and then be converted into an empty UserAPIKeyAuth() object. The request was therefore not rejected at the boundary where the credential had already failed validation.

The security lesson is broader than LiteLLM: passthrough authentication must be tied to an explicitly configured upstream identity boundary. “This token was not valid here” is not evidence that it is valid somewhere else. Authentication fallback paths for agent gateways should fail closed when the target server, issuer or audience cannot be established.

This page is intentionally defensive. Do not probe third-party or production systems with fabricated credentials. Determine exposure from owned configuration, deployment versions, perimeter rules and logs.

Operator runbook

Patch the runtime, then prove the old path is no longer reachable

Check	Action	Decision boundary
Version	Confirm the deployed LiteLLM version, not only the lockfile or image tag.	< 1.84.0 is affected according to the reviewed advisory.
Reachability	Determine whether MCP Streamable HTTP routes were reachable from untrusted networks.	Internet exposure raises remediation urgency.
Upgrade	Move to LiteLLM 1.84.0 or later and restart the actual serving instances.	Verify runtime version after rollout.
Contain	If immediate upgrade is impossible, block or disable MCP HTTP routes at the perimeter.	Do not rely on an invalid-token test as a compensating control.
Review	Inspect access logs, MCP server targeting, unusual sessions and downstream tool activity.	Treat unknown historical access as an investigation problem.
Rotate	Rotate provider, cloud or service credentials that were reachable through exposed MCP tools when compromise cannot be excluded.	Patching does not revoke previously exposed credentials.

Exposure triage

Separate “vulnerable version” from “credible impact”

A vulnerable package version establishes remediation need, but actual blast radius depends on the deployed MCP topology. Record whether the Streamable HTTP endpoint was reachable, which MCP servers could be targeted, which server policies permitted an otherwise empty identity, and which downstream services those tools could access.

The GitHub advisory states that an attacker could use the flaw to list and call configured MCP tools. Independent root-cause work has also highlighted an important permission boundary: an empty identity does not automatically imply every configured tool is reachable in every deployment. Treat your server-level permissions and allow_all_keys-style settings as evidence to inspect, not assumptions to make.

If the endpoint was public and you cannot rule out unauthorized sessions, rotate credentials reachable through exposed MCP tools and review downstream logs. The correct post-incident state is “patched and investigated”, not merely “package upgraded”.

Post-patch verification

Verify configuration, identity boundaries and tool permissions

Confirm the running LiteLLM process reports version 1.84.0 or later after deployment.
Confirm MCP routes that should be private are still private at the reverse proxy, load balancer or network policy layer.
Review OAuth2 passthrough only for servers that explicitly require it; do not use permissive fallback as a generic compatibility strategy.
Review MCP server permissions so unauthenticated or empty identities cannot inherit broad “all keys” access.
Keep service credentials scoped to the minimum tool actions required; gateway compromise should not become unrestricted downstream authority.
Preserve authentication and MCP call logs long enough to reconcile suspicious historical activity after a security update.

For protocol-level authorization debugging, see the MCP OAuth 401/403 troubleshooting guide. Before connecting a new external server, use the MCP server verification checklist. Qualified buyers can inspect zFinia's machine-service catalogue at /api.

Primary sources