LiteLLM MCP Auth Bypass CVE-2026-59822 Lands in CISA KEV
CVE-2026-59822 (CVSS 8.2, GHSA-7488-6r32-c95q) is an authentication bypass in LiteLLM before 1.84.0 on the MCP Streamable HTTP OAuth2 passthrough path. CISA added it to the KEV catalog on 2 September 2026 with a federal deadline of 16 September 2026. This advisory covers the new CVE only - it is not a rehash of earlier LiteLLM gateway bugs.
What happened
On vulnerable LiteLLM builds, MCP Streamable HTTP could take a fabricated Authorization header, enter OAuth2 passthrough, and continue with an empty UserAPIKeyAuth. In practical terms, MCP requests could be handled without a validated user API key identity. The maintained fix is LiteLLM 1.84.0. Until you can upgrade, operators can disable the surface with LITELLM_MCP_STREAMABLE_HTTP_ENABLED=false.
The temporary control is the environment variable above; upgrade remains the durable fix. Coverage from GitHub advisory GHSA-7488-6r32-c95q and follow-on forensic write-ups (including Sherlock Forensics around 5 September 2026) describe the same empty-auth object failure mode.
Do not conflate this with prior LiteLLM posts on this site. The MCP-preview RCE CVE-2026-42271, pre-auth SQLi CVE-2026-42208, and the Starlette BadHost auth bypass CVE-2026-48710 are separate issues - some of which also hit KEV in earlier waves. CVE-2026-59822 is a new MCP HTTP auth-bypass entry.
Why this is an agentic-endpoint risk
LiteLLM sits where agents and MCP clients meet model providers. An auth bypass on the MCP Streamable HTTP path means tool traffic can reach the gateway without the identity controls you thought were mandatory. That is the same class of failure discussed in AI gateway OAuth passthrough for MCP: passthrough features that widen connectivity also widen who can pretend to be a caller.
From Network and EDR you still see TLS to a known gateway. From DLP you may see nothing at rest. The question for the fleet is which endpoints and agents are configured to reach which LiteLLM instances, whether those instances still run builds before 1.84.0, and which MCP tool calls are allowed to proceed. That is the AI artifact layer - MCP servers, gateways, and OAuth AI grants - not a classic host CVE alone. See the pillar on securing LLM gateways and proxies.
How Anomity surfaces and governs it
Upgrading to 1.84.0 (or disabling Streamable HTTP until you can) closes this CVE. The durable control is still to inventory MCP and gateway reachability and to gate unsafe tool calls while patches roll out.
First, inventory. Anomity's Endpoint Sensor inventories MCP servers and related agent/CLI configuration on managed endpoints. Cloud discovery can surface Google Workspace / GitHub OAuth AI grants so gateway-adjacent identity sprawl is visible alongside local MCP configs. Metadata only; secrets are redacted on the endpoint.
Second, decide at the hook. On agents that expose a hook such as Claude Code PreToolUse, runtime governance returns allow, deny, or log before a tool call runs - so high-risk MCP paths can be denied even while a LiteLLM build before 1.84.0 is still being upgraded.
Third, keep the record. Decisions and artifact changes land in a queryable 90-day audit trail and can route to SIEM, Slack, email, or Jira. When a KEV item like CVE-2026-59822 lands with a 16 September 2026 deadline, you want a record of which agents talked to which gateways - not a spreadsheet rebuilt under pressure. Anomity is SOC 2 Type II and complements Network, EDR, DLP, and GRC. Book a 30-minute demo.
What to check across your fleet
- Find every LiteLLM deployment; flag anything before 1.84.0 and upgrade ahead of the 16 September 2026 KEV deadline where that SLA applies.
- If you cannot upgrade immediately, set
LITELLM_MCP_STREAMABLE_HTTP_ENABLED=falseand confirm MCP Streamable HTTP is actually off. - Review access logs for MCP Streamable HTTP requests with unusual Authorization values during the vulnerable window.
- Reconcile which coding agents and MCP clients are configured to use each LiteLLM base URL.
- Cross-check exposed gateways against prior LiteLLM KEV-class issues such as CVE-2026-42271 without treating them as the same bug.
- Confirm MCP tool calls are evaluated with allow/deny/log and recorded in a 90-day audit trail.
CVE-2026-59822 is a reminder that MCP HTTP features on LLM gateways are authentication-critical surfaces, not convenience toggles. Upgrade to 1.84.0, keep Streamable HTTP off until you do, and inventory which agents can reach the gateway. For the broader gateway attack surface, see securing LLM gateways and proxies. To see Anomity inventory MCP and gateway reachability across your fleet, request early access.
Frequently asked questions
What is CVE-2026-59822 in LiteLLM?
CVE-2026-59822 is a high-severity authentication bypass rated CVSS 8.2 and tracked as GitHub security advisory GHSA-7488-6r32-c95q. In LiteLLM versions before 1.84.0, the MCP Streamable HTTP OAuth2 passthrough path could accept a fabricated Authorization header and continue with an empty UserAPIKeyAuth object, effectively skipping real API-key authentication for MCP traffic.
How does the OAuth2 passthrough bypass work?
LiteLLM's MCP Streamable HTTP mode can pass through OAuth2-style Authorization material. On the vulnerable builds, crafted Authorization input caused the gateway to treat the request as an OAuth passthrough case and instantiate an empty UserAPIKeyAuth. Downstream MCP handling then ran as if an authenticated user context existed, without validating a real user API key.
What is the CISA KEV status and deadline?
CISA added CVE-2026-59822 to the Known Exploited Vulnerabilities catalog on 2 September 2026. The federal remediation deadline listed with that KEV entry is 16 September 2026. Agencies and any organization that mirrors KEV SLAs should treat internet-exposed LiteLLM MCP Streamable HTTP endpoints as priority patch items.
How do I fix or work around CVE-2026-59822?
Upgrade LiteLLM to 1.84.0 or later, which fixes the empty UserAPIKeyAuth passthrough behavior. If you cannot upgrade immediately, disable MCP Streamable HTTP with LITELLM_MCP_STREAMABLE_HTTP_ENABLED=false, then schedule the upgrade and review access logs for suspicious Authorization activity against MCP endpoints.
Is this the same as earlier LiteLLM CVEs on Anomity's blog?
No. CVE-2026-59822 is a distinct MCP Streamable HTTP authentication bypass. Prior Anomity advisories cover different LiteLLM issues, including the MCP-preview command-injection RCE CVE-2026-42271, pre-auth SQL injection CVE-2026-42208, and related privilege-escalation CVEs. Treat 59822 as a new KEV item on the MCP HTTP surface, not a duplicate write-up.
How does Anomity reduce exposure to this class of flaw?
Anomity inventories MCP servers and related gateway/CLI reachability on managed endpoints as part of the eight AI artifact types it tracks, and cloud discovery can surface Google Workspace and GitHub OAuth AI grants. On agents that expose a hook, Anomity returns allow, deny, or log before a tool call runs, so unsafe MCP tool paths can be denied while a vulnerable LiteLLM build is still being upgraded. Decisions land in a 90-day audit trail routed to SIEM, Slack, email, or Jira, with secrets redacted on-endpoint.
