LiteLLM Proxy at a glance
CISA added CVE-2026-59822 to its KEV catalog on September 2, 2026. A forged bearer token could open an MCP session on LiteLLM before 1.84.0 and call connected tools. A June KEV entry, CVE-2026-42271, also hit LiteLLM.
LiteLLM Proxy: status
- Affected
- LiteLLM versions before 1.84.0 (CVE-2026-59822)
- LiteLLM 1.74.2 up to but not including 1.83.7 (CVE-2026-42271)
- Status as of
- Discovered by
- Reporters yaaras (CVE-2026-59822) and Youns92 (CVE-2026-42271), credited in LiteLLM's advisories
What changed with LiteLLM Proxy
LiteLLM's advisory GHSA-7488-6r32-c95q, published June 30, 2026, describes an authentication bypass in the MCP Streamable HTTP endpoint of LiteLLM Proxy before 1.84.0. When OAuth2 passthrough to an upstream MCP server failed, a fallback replaced the failed LiteLLM key check with an empty auth object, so a request with any made-up Authorization header could start an authenticated MCP session, list configured MCP tools, call them, and reach connected services. NVD rates it 8.2 (high); the advisory gives a CVSS 4.0 score of 8.8.
On September 2, 2026, CISA added CVE-2026-59822 to its Known Exploited Vulnerabilities catalog, with a federal remediation deadline of September 16. Earlier, on June 8, CISA had listed CVE-2026-42271: in LiteLLM 1.74.2 up to 1.83.7, two MCP test endpoints would launch a supplied command on the proxy host for any holder of a valid API key, without checking for an admin role.
Both bugs are fixed: upgrade to 1.84.0 or later. If you cannot upgrade right away, LiteLLM suggests disabling MCP routes or blocking /mcp/ at a reverse proxy or API gateway, and for the older bug, blocking POST /mcp-rest/test/connection and /mcp-rest/test/tools/list.
How to fix it: LiteLLM Proxy
1. Update
Upgrade LiteLLM to 1.84.0 or later, which also includes the 1.83.7 fix for CVE-2026-42271.
github.com (opens in a new tab)2. Workaround
If you cannot upgrade, disable MCP routes or block /mcp/ and related MCP endpoints at a reverse proxy or API gateway.
github.com (opens in a new tab)3. Workaround
For versions before 1.83.7, block POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list at your reverse proxy or API gateway.
github.com (opens in a new tab)
Advisories
Where to compare LiteLLM Proxy
Independent leaderboards and official resources for comparing this model yourself. Rankings change often; each site shows its own current data.
Why LiteLLM Proxy matters for businesses
Gateways that expose MCP tools hand an AI agent's reach to whoever can reach the gateway. Two exploited LiteLLM flaws in one summer show that MCP endpoints need the same authentication review and patch speed as any other internet-facing admin surface, especially when tools connect to CRMs, databases, or internal APIs.
Sources for this story
- Official
- MCP Authentication Bypass via OAuth2 Passthrough Fallback (GHSA-7488-6r32-c95q) (opens in a new tab)Official
BerriAI/litellm on GitHub · github.com
- Authenticated command execution via MCP stdio test endpoints (GHSA-v4p8-mg3p-g94g) (opens in a new tab)Official
BerriAI/litellm on GitHub · github.com
- CVE-2026-59822 Detail (opens in a new tab)Official
NIST National Vulnerability Database · nvd.nist.gov
- CVE-2026-42271 Detail (opens in a new tab)Official
NIST National Vulnerability Database · nvd.nist.gov
Last verified: . IA Compa summarizes public announcements for business readers. We are not affiliated with the companies mentioned. Always confirm details, pricing, and availability with the official source.
- #security
- #cve
- #litellm
- #mcp
- #cisa-kev
- #actively-exploited
- #ai-gateway