Skip to content
Log inStart free trial

GHSA-7488-6r32-c95q CVE-2026-59822 PYSEC-2026-3479

LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback

High Known exploited PyPI
Severity
8.8 / 10
High · CVSS 4.0
Exploit chance (EPSS)
0.84%
Chance of exploitation in the next 30 days. Higher than 57.73% of scored vulnerabilities.
Known exploited
Yes
In CISA's catalog since Sep 2, 2026
Weakness
CWE-287 Improper Authentication
Fix
1.84.0
Upgrade litellm to this version or later
Exploited in the wild. BerriAI LiteLLM Improper Authentication Vulnerability (BerriAI LiteLLM). Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Due for U.S. federal agencies by Sep 16, 2026.

Description

Impact

LiteLLM's MCP Streamable HTTP endpoint could allow an unauthenticated attacker to establish an authenticated MCP session using an arbitrary Bearer token.

The MCP auth handler supported OAuth2 passthrough for upstream MCP servers, but the fallback path could replace failed LiteLLM key validation with an empty UserAPIKeyAuth() object. This allowed requests with a fabricated Authorization header to reach MCP tooling without a valid LiteLLM key.

An attacker could use this to list and call configured MCP tools and access connected services exposed through MCP.

Patches

The issue is fixed in 1.84.0.

We recommend upgrading to 1.84.0 or later.

Workarounds

If upgrading is not immediately possible, disable MCP routes or block access to /mcp/ and related MCP endpoints at your reverse proxy or API gateway.

References

Affected versions

PyPI

PackageVulnerableFixed in
litellm
< 1.84.0
1.84.0
litellm
< 1.84.0
1.84.0
litellm
< 1.84.0
1.84.0

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

litellm PyPI → 1.84.0

pip
pip install --upgrade "litellm>=1.84.0"
poetry
poetry add "litellm>=1.84.0"
uv
uv add "litellm>=1.84.0"

Severity breakdown

CVSS 4.0 8.8

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Attack vector
Network
Attack complexity
Low
Attack requirements
None
Privileges required
None
User interaction
None
Confidentiality (vulnerable system)
High
Integrity (vulnerable system)
Low
Availability (vulnerable system)
None
Confidentiality (subsequent systems)
None
Integrity (subsequent systems)
None
Availability (subsequent systems)
None

CVSS 3.1 8.2

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
Low
Availability
None

Weakness

CWE-287: Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

How to prevent it
  • Architecture and Design: Use an authentication framework or library such as the OWASP ESAPI Authentication feature.

References

Advisories

Fixes and patches

Packages

Other links

Timeline

  1. Published
  2. Added to CISA's Known Exploited Vulnerabilities catalog
  3. Remediation due for U.S. federal agencies
  4. Last updated by the source
  5. Latest EPSS score
AdvisorySeverityWhy it's related
GHSA-v4p8-mg3p-g94g
LiteLLM: Authenticated command execution via MCP stdio test endpoints
High Known exploited Also affects litellm
GHSA-r75f-5x8p-qvmc
LiteLLM has SQL Injection in Proxy API key verification
Critical Known exploited Also affects litellm
GHSA-g5ff-637f-6q2m
LiteLLM: internal_user_viewer arbitrary local file read via `vertex_ai_credentials`
High Also affects litellm
GHSA-hhww-mrg2-969h
LiteLLM vulnerable to reflected XSS in /sso/debug/callback
Medium Also affects litellm
GHSA-7hp6-4w63-5g45
LiteLLM: Privilege Escalation to Proxy Admin via Cross-Domain Reuse of the Salt Key
Critical Also affects litellm
GHSA-hx8v-g79f-8w5f
LiteLLM Proxy has server-side request forgery via the `user_config` request parameter
Medium Also affects litellm
GHSA-3cv6-jpf6-8222
LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parameters
Medium Also affects litellm
GHSA-6wvf-77m9-58rm
LiteLLM vulnerable to server-side template injection in the /prompts/test endpoint
Critical Also affects litellm

Credits: yaaras

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor