--- title: "LiteLLM MCP Auth Bypass CVE-2026-59822 Lands in CISA KEV" description: "CVE-2026-59822 (CVSS 8.2, GHSA-7488-6r32-c95q): LiteLLM MCP Streamable HTTP OAuth2 passthrough yielded empty UserAPIKeyAuth. Fixed in 1.84.0; CISA KEV deadline 2026-09-16." url: "https://anomity.ai/blog/litellm-mcp-oauth-passthrough-auth-bypass-cve-2026-59822/" source: html --- On this page - What happened - Why this is an agentic-endpoint risk - How Anomity surfaces and governs it - What to check across your fleet - Frequently asked questions [← Back to blog](https://anomity.ai/blog/) - Home - Blog - LiteLLM MCP Auth Bypass CVE-2026-59822 Lands in CISA KEV ![Anomity robot illustrating LiteLLM MCP Auth Bypass CVE-2026-59822 Lands in CISA KEV] Advisory High # LiteLLM MCP Auth Bypass CVE-2026-59822 Lands in CISA KEV Anomity Research Anomity Threat Research · Sep 14, 2026 · 4 min read Share: Copied MCP Server Security · High · CVE-2026-59822 (CVSS 8.2, GHSA-7488-6r32-c95q) · Sep 14, 2026 Affected LiteLLM before 1.84.0 (MCP Streamable HTTP OAuth2 passthrough path) **CVE-2026-59822** (CVSS **8.2**, **GHSA-7488-6r32-c95q**) is an authentication bypass in **LiteLLM** before **1.84.0** on the **MCP Streamable HTTP** OAuth2 passthrough path. **CISA** added it to the **KEV** catalog on **2 September 2026** with a federal deadline of **16 September 2026**. This advisory covers the new CVE only - it is not a rehash of earlier LiteLLM gateway bugs. ## What happened On vulnerable LiteLLM builds, MCP Streamable HTTP could take a fabricated **Authorization** header, enter **OAuth2 passthrough**, and continue with an **empty UserAPIKeyAuth**. In practical terms, MCP requests could be handled **without a validated user API key identity**. The maintained fix is **LiteLLM 1.84.0**. Until you can upgrade, operators can disable the surface with **LITELLM_MCP_STREAMABLE_HTTP_ENABLED=false**. The temporary control is the environment variable above; upgrade remains the durable fix. Coverage from GitHub advisory **GHSA-7488-6r32-c95q** and follow-on forensic write-ups (including Sherlock Forensics around **5 September 2026**) describe the same empty-auth object failure mode. Do **not** conflate this with prior LiteLLM posts on this site. The [MCP-preview RCE CVE-2026-42271](https://anomity.ai/blog/litellm-mcp-preview-rce-cve-2026-42271/), [pre-auth SQLi CVE-2026-42208](https://anomity.ai/blog/litellm-pre-auth-sqli-cve-2026-42208/), and the [Starlette BadHost auth bypass CVE-2026-48710](https://anomity.ai/blog/starlette-badhost-host-header-auth-bypass-cve-2026-48710/) are separate issues - some of which also hit KEV in earlier waves. **CVE-2026-59822** is a new MCP HTTP auth-bypass entry. ## Why this is an agentic-endpoint risk LiteLLM sits where agents and MCP clients meet model providers. An auth bypass on the MCP Streamable HTTP path means **tool traffic can reach the gateway without the identity controls you thought were mandatory**. That is the same class of failure discussed in [AI gateway OAuth passthrough for MCP](https://anomity.ai/blog/ai-gateway-oauth-passthrough-mcp/): passthrough features that widen connectivity also widen who can pretend to be a caller. From Network and EDR you still see TLS to a known gateway. From DLP you may see nothing at rest. The question for the fleet is which endpoints and agents are configured to reach which LiteLLM instances, whether those instances still run builds before **1.84.0**, and which MCP tool calls are allowed to proceed. That is the [AI artifact layer](https://anomity.ai/#features) - MCP servers, gateways, and OAuth AI grants - not a classic host CVE alone. See the pillar on [securing LLM gateways and proxies](https://anomity.ai/blog/securing-llm-gateways-and-proxies/). ## How Anomity surfaces and governs it Upgrading to **1.84.0** (or disabling Streamable HTTP until you can) closes this CVE. The durable control is still to **inventory MCP and gateway reachability** and to **gate unsafe tool calls** while patches roll out. First, **inventory**. Anomity's Endpoint Sensor inventories MCP servers and related agent/CLI configuration on managed endpoints. **Cloud discovery** can surface **Google Workspace / GitHub OAuth** AI grants so gateway-adjacent identity sprawl is visible alongside local MCP configs. Metadata only; secrets are redacted on the endpoint. Second, **decide at the hook**. On agents that expose a hook such as Claude Code **PreToolUse**, [runtime governance](https://anomity.ai/#runtime-governance) returns **allow, deny, or log** before a tool call runs - so high-risk MCP paths can be denied even while a LiteLLM build before **1.84.0** is still being upgraded. Third, **keep the record**. Decisions and artifact changes land in a [queryable 90-day audit trail](https://anomity.ai/#outcomes) and can route to SIEM, Slack, email, or Jira. When a KEV item like **CVE-2026-59822** lands with a **16 September 2026** deadline, you want a record of which agents talked to which gateways - not a spreadsheet rebuilt under pressure. Anomity is SOC 2 Type II and complements Network, EDR, DLP, and GRC. [Book a 30-minute demo](https://anomity.ai/#early-access). ## What to check across your fleet - Find every LiteLLM deployment; flag anything before 1.84.0 and upgrade ahead of the 16 September 2026 KEV deadline where that SLA applies. - If you cannot upgrade immediately, set LITELLM_MCP_STREAMABLE_HTTP_ENABLED=false and confirm MCP Streamable HTTP is actually off. - Review access logs for MCP Streamable HTTP requests with unusual Authorization values during the vulnerable window. - Reconcile which coding agents and MCP clients are configured to use each LiteLLM base URL. - Cross-check exposed gateways against prior LiteLLM KEV-class issues such as CVE-2026-42271 without treating them as the same bug. - Confirm MCP tool calls are evaluated with allow/deny/log and recorded in a 90-day audit trail . **CVE-2026-59822** is a reminder that MCP HTTP features on LLM gateways are authentication-critical surfaces, not convenience toggles. Upgrade to **1.84.0**, keep Streamable HTTP off until you do, and inventory which agents can reach the gateway. For the broader gateway attack surface, see [securing LLM gateways and proxies](https://anomity.ai/blog/securing-llm-gateways-and-proxies/). To see Anomity inventory MCP and gateway reachability across your fleet, [request early access](https://anomity.ai/#early-access). Share: Copied ## Frequently asked questions What is CVE-2026-59822 in LiteLLM? CVE-2026-59822 is a high-severity authentication bypass rated CVSS 8.2 and tracked as GitHub security advisory GHSA-7488-6r32-c95q. In LiteLLM versions before 1.84.0, the MCP Streamable HTTP OAuth2 passthrough path could accept a fabricated Authorization header and continue with an empty UserAPIKeyAuth object, effectively skipping real API-key authentication for MCP traffic. How does the OAuth2 passthrough bypass work? LiteLLM's MCP Streamable HTTP mode can pass through OAuth2-style Authorization material. On the vulnerable builds, crafted Authorization input caused the gateway to treat the request as an OAuth passthrough case and instantiate an empty UserAPIKeyAuth. Downstream MCP handling then ran as if an authenticated user context existed, without validating a real user API key. What is the CISA KEV status and deadline? CISA added CVE-2026-59822 to the Known Exploited Vulnerabilities catalog on 2 September 2026. The federal remediation deadline listed with that KEV entry is 16 September 2026. Agencies and any organization that mirrors KEV SLAs should treat internet-exposed LiteLLM MCP Streamable HTTP endpoints as priority patch items. How do I fix or work around CVE-2026-59822? Upgrade LiteLLM to 1.84.0 or later, which fixes the empty UserAPIKeyAuth passthrough behavior. If you cannot upgrade immediately, disable MCP Streamable HTTP with LITELLM_MCP_STREAMABLE_HTTP_ENABLED=false, then schedule the upgrade and review access logs for suspicious Authorization activity against MCP endpoints. Is this the same as earlier LiteLLM CVEs on Anomity's blog? No. CVE-2026-59822 is a distinct MCP Streamable HTTP authentication bypass. Prior Anomity advisories cover different LiteLLM issues, including the MCP-preview command-injection RCE CVE-2026-42271, pre-auth SQL injection CVE-2026-42208, and related privilege-escalation CVEs. Treat 59822 as a new KEV item on the MCP HTTP surface, not a duplicate write-up. How does Anomity reduce exposure to this class of flaw? Anomity inventories MCP servers and related gateway/CLI reachability on managed endpoints as part of the eight AI artifact types it tracks, and cloud discovery can surface Google Workspace and GitHub OAuth AI grants. On agents that expose a hook, Anomity returns allow, deny, or log before a tool call runs, so unsafe MCP tool paths can be denied while a vulnerable LiteLLM build is still being upgraded. Decisions land in a 90-day audit trail routed to SIEM, Slack, email, or Jira, with secrets redacted on-endpoint. ## Related [Guide ### How MCP Servers Expose Enterprise Secrets: Five Paths and the CVEs Behind Them MCP servers are where agent credentials actually live. Five exposure paths - plaintext config, sprawl, injection, over-permissioning, and the server supply chain - with the CVEs that prove each one. Anomity Research · Aug 17, 2026 · 9 min](https://anomity.ai/blog/mcp-server-secrets-exposure-enterprise-credentials/) [Advisory Critical ### Terraform MCP Server Credential Reuse (CVSS 10.0), Veeam VSPC, and Django - August 2026 Patches CVE-2026-16498 scores CVSS 10.0: Terraform MCP Server reuses one tenant's token across requests. Veeam VSPC and Django were also patched in August 2026. Anomity Research · Aug 10, 2026 · CVE-2026-16498 (CVSS 10.0), CVE-2026-16496, CVE-2026-14869, CVE-2026-58073, CVE-2026-58072, CVE-2026-15307](https://anomity.ai/blog/terraform-mcp-veeam-django-august-2026-patches/) [Advisory High ### MCP fURI: SSRF in Microsoft's MarkItDown Server, and the 36.7% of MCP Servers Sharing the Pattern BlueRock found SSRF in Microsoft's MarkItDown MCP server - reaching EC2 metadata for IAM keys - and reports ~36.7% of 7,000+ MCP servers share the pattern. Anomity Research · Aug 5, 2026 · MCP fURI (BlueRock Security) - SSRF in Microsoft MarkItDown MCP; ecosystem-scale pattern](https://anomity.ai/blog/mcp-furi-markitdown-ssrf-ecosystem-scale/) ## Structured data ```json { "@context": "https://schema.org", "@type": "TechArticle", "headline": "LiteLLM MCP Auth Bypass CVE-2026-59822 Lands in CISA KEV", "description": "CVE-2026-59822 (CVSS 8.2, GHSA-7488-6r32-c95q): LiteLLM MCP Streamable HTTP OAuth2 passthrough yielded empty UserAPIKeyAuth. Fixed in 1.84.0; CISA KEV deadline 2026-09-16.", "datePublished": "2026-09-14", "dateModified": "2026-09-14", "author": { "@type": "Organization", "name": "Anomity", "url": "https://anomity.ai/", "sameAs": [ "https://www.linkedin.com/company/anomity", "https://github.com/Anomity-ai", "https://www.wikidata.org/wiki/Q140763940" ] }, "publisher": { "@type": "Organization", "name": "Anomity", "url": "https://anomity.ai/", "sameAs": [ "https://www.linkedin.com/company/anomity", "https://github.com/Anomity-ai", "https://www.wikidata.org/wiki/Q140763940" ], "logo": { "@type": "ImageObject", "url": "https://anomity.ai/icon-512.png" } }, "mainEntityOfPage": { "@type": "WebPage", "@id": "https://anomity.ai/blog/litellm-mcp-oauth-passthrough-auth-bypass-cve-2026-59822/" }, "image": { "@type": "ImageObject", "url": "https://anomity.ai/assets/blog/covers/prompt-injection.jpg", "width": 1200, "height": 630 }, "articleSection": "MCP Server Security", "url": "https://anomity.ai/blog/litellm-mcp-oauth-passthrough-auth-bypass-cve-2026-59822/", "keywords": "LiteLLM CVE-2026-59822 MCP auth bypass, CVE-2026-59822 (CVSS 8.2, GHSA-7488-6r32-c95q), LiteLLM, CVE-2026-59822, MCP, OAuth passthrough, auth bypass, CISA KEV, LLM gateway, agentic AI security" } ``` ```json { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "What is CVE-2026-59822 in LiteLLM?", "acceptedAnswer": { "@type": "Answer", "text": "CVE-2026-59822 is a high-severity authentication bypass rated CVSS 8.2 and tracked as GitHub security advisory GHSA-7488-6r32-c95q. In LiteLLM versions before 1.84.0, the MCP Streamable HTTP OAuth2 passthrough path could accept a fabricated Authorization header and continue with an empty UserAPIKeyAuth object, effectively skipping real API-key authentication for MCP traffic." } }, { "@type": "Question", "name": "How does the OAuth2 passthrough bypass work?", "acceptedAnswer": { "@type": "Answer", "text": "LiteLLM's MCP Streamable HTTP mode can pass through OAuth2-style Authorization material. On the vulnerable builds, crafted Authorization input caused the gateway to treat the request as an OAuth passthrough case and instantiate an empty UserAPIKeyAuth. Downstream MCP handling then ran as if an authenticated user context existed, without validating a real user API key." } }, { "@type": "Question", "name": "What is the CISA KEV status and deadline?", "acceptedAnswer": { "@type": "Answer", "text": "CISA added CVE-2026-59822 to the Known Exploited Vulnerabilities catalog on 2 September 2026. The federal remediation deadline listed with that KEV entry is 16 September 2026. Agencies and any organization that mirrors KEV SLAs should treat internet-exposed LiteLLM MCP Streamable HTTP endpoints as priority patch items." } }, { "@type": "Question", "name": "How do I fix or work around CVE-2026-59822?", "acceptedAnswer": { "@type": "Answer", "text": "Upgrade LiteLLM to 1.84.0 or later, which fixes the empty UserAPIKeyAuth passthrough behavior. If you cannot upgrade immediately, disable MCP Streamable HTTP with LITELLM_MCP_STREAMABLE_HTTP_ENABLED=false, then schedule the upgrade and review access logs for suspicious Authorization activity against MCP endpoints." } }, { "@type": "Question", "name": "Is this the same as earlier LiteLLM CVEs on Anomity's blog?", "acceptedAnswer": { "@type": "Answer", "text": "No. CVE-2026-59822 is a distinct MCP Streamable HTTP authentication bypass. Prior Anomity advisories cover different LiteLLM issues, including the MCP-preview command-injection RCE CVE-2026-42271, pre-auth SQL injection CVE-2026-42208, and related privilege-escalation CVEs. Treat 59822 as a new KEV item on the MCP HTTP surface, not a duplicate write-up." } }, { "@type": "Question", "name": "How does Anomity reduce exposure to this class of flaw?", "acceptedAnswer": { "@type": "Answer", "text": "Anomity inventories MCP servers and related gateway/CLI reachability on managed endpoints as part of the eight AI artifact types it tracks, and cloud discovery can surface Google Workspace and GitHub OAuth AI grants. On agents that expose a hook, Anomity returns allow, deny, or log before a tool call runs, so unsafe MCP tool paths can be denied while a vulnerable LiteLLM build is still being upgraded. Decisions land in a 90-day audit trail routed to SIEM, Slack, email, or Jira, with secrets redacted on-endpoint." } } ] } ``` ```json { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://anomity.ai/" }, { "@type": "ListItem", "position": 2, "name": "Blog", "item": "https://anomity.ai/blog/" }, { "@type": "ListItem", "position": 3, "name": "LiteLLM MCP Auth Bypass CVE-2026-59822 Lands in CISA KEV", "item": "https://anomity.ai/blog/litellm-mcp-oauth-passthrough-auth-bypass-cve-2026-59822/" } ] } ```