CVE-2026-59822 BerriAI LiteLLM Improper Authentication
Unauthenticated attackers can bypass LiteLLM key validation via OAuth2 fallback to access MCP tooling without valid credentials.
- Exploited in the wild
- Since 2 Sep 2026
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-59822?
CVE-2026-59822 is a high-severity authentication bypass vulnerability in BerriAI litellm, published on 8 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.84.0, LiteLLM's MCP Streamable HTTP endpoint allowed an unauthenticated attacker to use a fabricated Authorization header to trigger an OAuth2 passthrough fallback path that replaced failed LiteLLM key validation with an empty UserAPIKeyAuth() object, allowing requests to reach MCP tooling without a valid LiteLLM key. This issue is fixed in version 1.84.0.
Which versions are affected by CVE-2026-59822?
3 open source packages ship an affected version, including litellm. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
litellm PyPI | All versions | 1.84.0 |
litellm PyPI | All versions | 1.84.0 |
litellm PyPI | All versions | 1.84.0 |
Products include Litellm Litellm.
How do I fix CVE-2026-59822?
Upgrade litellm to 1.84.0 or later. US federal agencies must fix it by 16 Sep 2026.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-59822 being exploited?
Yes. Attackers have exploited CVE-2026-59822 in the wild since at least 2 Sep 2026.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in BerriAI litellm
Sources
Also known as ECHO-7929-641d-77eb, GHSA-7488-6r32-c95q, MINI-24xw-2vfx-m836, MINI-8wpr-cg2h-mm32, MINI-gj2x-9328-hw8v, MINI-h5jw-cp5c-g26h and 3 more.