Case litellm-cve-2026-59822-kevAI supply chainSep 2, 2026Worldwide

LiteLLM MCP gateway accepts any Bearer token (CVE-2026-59822); CISA confirms exploitation

When key validation failed, LiteLLM's MCP Streamable HTTP endpoint fell back to an empty auth object, so a single-character Bearer token gave full MCP tooling access; Wiz honeypots saw probes and CISA added it to KEV.

HighAttack on AIStatus: PatchedVerified case file

Open in the interactive map Cite this case

Reported: Sep 2, 2026
Location: Worldwide
Target: LiteLLM proxies before 1.84.0 exposing MCP
Severity: High
Triggered by: Unknown
Actor type: Unknown
Reported loss: None reported
CVE: CVE-2026-59822

What happened

Impact: Unauthenticated access to MCP tooling and model enumeration on exposed LiteLLM proxies; victim count not disclosed

Who triggered it

Actor: Unknown

Attribution: Opportunistic scanning observed in Wiz honeypots using Bearer x style tokens; CISA recorded active exploitation

Motive: Access to MCP tools and model endpoints behind AI gateways

How it happened

Attack vector: Fabricated Authorization header to the MCP endpoint triggering the OAuth2 passthrough fallback

Root cause: Fallback path substituted an unrestricted UserAPIKeyAuth object instead of rejecting failed validation

Timeline

Jul 8, 2026CVE-2026-59822 published; fixed in LiteLLM 1.84.0 (GHSA-7488-6r32-c95q)
Aug 27, 2026Wiz honeypot report documents single-character token probes against LiteLLM MCP
Sep 2, 2026CISA adds the CVE to the KEV catalog

Response

Upgrade to 1.84.0 or later; Wiz published IOCs and detection guidance

Current status: Patched

Sources (open in a new tab)

CISA KEV cisa.gov
LiteLLM advisory GHSA-7488-6r32-c95q github.com
Wiz wiz.io

Cite this case

LiteLLM MCP gateway accepts any Bearer token (CVE-2026-59822); CISA confirms exploitation. AI Threat Watch, case litellm-cve-2026-59822-kev, Sep 2, 2026. https://aithreat.io/cases/litellm-cve-2026-59822-kev/

Permanent link: https://aithreat.io/cases/litellm-cve-2026-59822-kev/