Mechanism: The OAuth2 Passthrough Fallback #
The vulnerability, tracked as CVE-2026-59822, originates in the authentication handler for the Model Context Protocol (MCP) within LiteLLM. LiteLLM serves as a proxy layer between enterprise applications and various LLM providers. The flaw exists in how the system manages authentication for upstream MCP servers.
When LiteLLM attempts to validate an incoming API key, a failure in the validation process triggers a fallback mechanism intended to support OAuth2 passthrough. Instead of rejecting the request when key validation fails, the system substitutes an empty UserAPIKeyAuth() object. This logic error allows a request containing a fabricated Authorization Bearer header to bypass standard security checks and reach the underlying MCP tooling. The vulnerability carries a CVSS score of 8.8, reflecting high severity due to the ease of exploitation and the potential for unauthorized access.
MCP Context: A First for the KEV Catalog #
On September 2, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog. It is the first MCP-related flaw to appear in the KEV. Under Binding Operational Directive 22-01, federal agencies are typically expected to remediate such vulnerabilities within two to three weeks of their addition to the catalog.
Impact: Unauthenticated Access to Tooling #
An unauthenticated remote attacker can leverage the bypass to interact with configured MCP tools. This access allows an attacker to list available tools and execute them, potentially gaining unauthorized access to connected services exposed through the MCP interface. Because LiteLLM acts as a central relay, the scope of this exposure is limited only by the tools and services connected to the proxy.
There is currently no evidence of public exploitation. No functional proof-of-concept exploit script has been published, and no active campaigns have been confirmed.
Patch and Workaround #
The vulnerability affects all LiteLLM versions prior to 1.84.0. The maintainers released a patch in version 1.84.0 on May 14, 2026. This fix modifies the authentication logic to ensure that the OAuth2 passthrough fallback only executes when every targeted server is explicitly configured by an operator with auth_type=oauth2. For organizations unable to update immediately, the recommended workaround is to disable MCP routes or block access to /mcp/ endpoints entirely.
Implications for MCP Trust Architecture #
CVE-2026-59822 demonstrates that the LiteLLM proxy failed to enforce strict authentication, allowing a fabricated Bearer token to reach MCP tooling. As noted in previous coverage of MCP Governance Surface and MCP Platform Battleground, the protocol relies on intermediary layers for security. Security professionals must treat the relay layer as a critical security boundary. Relying on upstream servers to handle authentication is insufficient if the proxy does not validate the request before transmission. Governance of these relay points is required for enterprise LLM integrations.