What happened
CISA added CVE-2026-59822 to its Known Exploited Vulnerabilities catalog on Sept 2, 2026. The flaw allows an unauthenticated attacker to establish an authenticated MCP session against a LiteLLM proxy using any Bearer token due to an insecure OAuth2 passthrough fallback. Wiz's 90-day AI-infrastructure honeypot research independently observed live exploitation attempts using single-character tokens to enumerate models.
Why it matters
LiteLLM centralizes credentials and routing for multiple LLM providers plus MCP tool connections; a bypass at this layer gives attackers direct access to proxied model-provider API keys, cloud IAM permissions, and any downstream service reachable via MCP — turning a gateway compromise into a much broader breach of AI infrastructure.
Attack vector
LiteLLM's OAuth2 passthrough fallback replaces a failed API-key validation with an empty/unrestricted auth object; an unauthenticated attacker can supply an arbitrary (even single-character) Bearer token to the MCP Streamable HTTP endpoint and establish a fully authenticated MCP session, gaining access to all connected tools and backend model-provider credentials.
Affected systems
BerriAI LiteLLM proxy, versions prior to 1.84.0 (MCP Streamable HTTP endpoint)
Mitigation
Upgrade to LiteLLM 1.84.0 or later; restrict/disable public exposure of MCP endpoints until patched. See GHSA-7488-6r32-c95q.