CVE-2026-59822 - PatchNow

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: DIRECT_NETWORK

CVE Published: 2026-07-08

Added to CISA KEV: 2026-09-02 56 DAYS BETWEEN CVE AND KEV

🎯 Recommendations:

CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review MCP endpoint access logs for requests with anomalous/fabricated Authorization headers, unauthorized MCP tooling access, and unexpected downstream LLM/API usage.
Immediately upgrade LiteLLM to version 1.84.0 or later to remediate the OAuth2 passthrough fallback flaw.
If patching is not immediately possible, restrict external access to the MCP Streamable HTTP endpoint, enforce strict API key policies, and use firewall/network segmentation to isolate MCP tooling from untrusted networks.
Monitor for anomalous MCP tool invocations and rotate any API keys or credentials managed by the proxy that may have been exposed.
Patch priority: URGENT/EMERGENCY — unauthenticated, automatable, actively exploited, KEV-listed.

🔍 Web Intelligence (Kagi · 2026-09-14)

Summary

CVE-2026-59822 is a critical authentication bypass vulnerability affecting LiteLLM, an AI Gateway and proxy server used to facilitate communication with various LLM APIs. The flaw resides within the Model Context Protocol (MCP) Streamable HTTP endpoint, where improper handling of the `Authorization` header allows an attacker to trigger an unintended OAuth2 passthrough fallback. This vulnerability is significant because it enables unauthenticated remote attackers to bypass API key validation and gain unauthorized access to MCP tooling and AI agent infrastructure.

Exploitation

Active Exploitation: The vulnerability is confirmed to be exploited in the wild and has been added to the CISA Known Exploited Vulnerabilities (KEV) catalog.
Threat Actors/Campaigns: Exploits have been observed targeting AI agent infrastructure, marking it as a notable security concern for organizations deploying AI proxies.
Proof-of-Concept/Tooling: While specific exploit scripts are widely discussed in security advisories, the simplicity of the attack (requiring only a fabricated header) facilitates exploitation.
Attack Prerequisites:

* Network: Exploitable remotely over the network. * Authentication: None required; the vulnerability is an authentication bypass. * User Interaction: No user interaction is required for a successful attack.

Affected Products & Patches

Affected Versions: All versions of LiteLLM prior to 1.84.0 are affected.
Patch/Hotfix: Users must upgrade to LiteLLM version 1.84.0 or later to resolve the vulnerability.
Mitigations: If an immediate upgrade is not possible, organizations should restrict external access to the MCP Streamable endpoint, enforce strict API key policies, and utilize network segmentation or firewall rules to isolate MCP tooling from untrusted network segments.

Impact

Unauthorized Access: Successful exploitation provides attackers with the ability to reach and interact with MCP tooling without valid credentials, effectively bypassing the proxy's authentication layer.
Business Risk: For internet-facing deployments, this vulnerability poses a severe risk to AI agent infrastructure, potentially leading to unauthorized data exfiltration, manipulation of AI agent behavior, and compromise of downstream AI services or sensitive API keys managed by the proxy.