A critical vulnerability in the widely used AI gateway LiteLLM allows unauthenticated attackers to establish a valid Model Context Protocol (MCP) session using an arbitrary Bearer token. The U.S. cyber agency CISA added the flaw, tracked as CVE-2026-59822, to its catalog of actively exploited vulnerabilities on 2 September 2026.
An empty auth context instead of an error
LiteLLM funnels access to many AI models behind a single interface and is run by numerous organizations as a central proxy. The bug sits in the Streamable HTTP endpoint for MCP: in versions before 1.84.0, a fabricated Authorization header triggered an OAuth2 passthrough fallback. Rather than rejecting a failed key check, LiteLLM replaced it with an empty UserAPIKeyAuth() object. Requests then reached the MCP tooling without any valid LiteLLM key at all. The vulnerability carries a CVSS score of 8.8 and is rated critical.
Through the forged session, attackers can list and call the configured MCP tools and thereby reach connected services that were meant to sit behind authentication. In many deployments that is enough to touch internal systems and data sources.
Active exploitation and mitigations
According to Google-owned security vendor Wiz, exploitation attempts were observed against its honeypots targeting model-enumeration endpoints; Wiz does not attribute this particular flaw to a specific threat actor. CISA requires U.S. federal agencies to patch by 16 September 2026.
- Update to LiteLLM 1.84.0 or later.
- Do not expose the MCP endpoint unprotected to the internet, and review access logs.
- Rotate issued API keys if access cannot be ruled out.
Sources: CISA · GitLab Advisory Database · The Hacker News
