The Relay Has No Lock: LiteLLM’s MCP Auth Bypass Marks a First for the CISA KEV Catalog

CISA added CVE-2026-59822, an authentication bypass in LiteLLM's Model Context Protocol handler, to its Known Exploited Vulnerabilities catalog on September 2, 2026, making it the first MCP-related flaw in the KEV. The vulnerability, rated CVSS 8.8, lets an unauthenticated remote attacker send a fabricated Authorization Bearer header to reach configured MCP tools in all LiteLLM versions prior to 1.84.0, which was patched on May 14, 2026. No public exploitation or proof-of-concept exploit script has been confirmed.

Mechanism: The OAuth2 Passthrough Fallback The vulnerability, tracked as CVE-2026-59822 https://github.com/BerriAI/litellm/security/advisories/GHSA-7488-6r32-c95q , originates in the authentication handler for the Model Context Protocol MCP within LiteLLM. LiteLLM serves as a proxy layer between enterprise applications and various LLM providers. The flaw exists in how the system manages authentication for upstream MCP servers. When LiteLLM attempts to validate an incoming API key, a failure in the validation process triggers a fallback mechanism intended to support OAuth2 passthrough. Instead of rejecting the request when key validation fails, the system substitutes an empty UserAPIKeyAuth object. This logic error allows a request containing a fabricated Authorization Bearer header to bypass standard security checks and reach the underlying MCP tooling. The vulnerability carries a CVSS score of 8.8 https://nvd.nist.gov/vuln/detail/CVE-2026-59822 , reflecting high severity due to the ease of exploitation and the potential for unauthorized access. MCP Context: A First for the KEV Catalog On September 2, 2026, the Cybersecurity and Infrastructure Security Agency CISA added this vulnerability to its Known Exploited Vulnerabilities KEV catalog https://www.cisa.gov/known-exploited-vulnerabilities-catalog . It is the first MCP-related flaw to appear in the KEV. Under Binding Operational Directive 22-01, federal agencies are typically expected to remediate such vulnerabilities within two to three weeks of their addition to the catalog. Impact: Unauthenticated Access to Tooling An unauthenticated remote attacker can leverage the bypass to interact with configured MCP tools. This access allows an attacker to list available tools and execute them, potentially gaining unauthorized access to connected services exposed through the MCP interface. Because LiteLLM acts as a central relay, the scope of this exposure is limited only by the tools and services connected to the proxy. There is currently no evidence of public exploitation. No functional proof-of-concept exploit script has been published, and no active campaigns have been confirmed. Patch and Workaround The vulnerability affects all LiteLLM versions prior to 1.84.0 https://github.com/BerriAI/litellm/releases/tag/v1.84.0 . The maintainers released a patch in version 1.84.0 on May 14, 2026. This fix modifies the authentication logic to ensure that the OAuth2 passthrough fallback only executes when every targeted server is explicitly configured by an operator with auth type=oauth2. For organizations unable to update immediately, the recommended workaround is to disable MCP routes or block access to /mcp/ endpoints entirely. Implications for MCP Trust Architecture CVE-2026-59822 demonstrates that the LiteLLM proxy failed to enforce strict authentication, allowing a fabricated Bearer token to reach MCP tooling. As noted in previous coverage of MCP Governance Surface and MCP Platform Battleground, the protocol relies on intermediary layers for security. Security professionals must treat the relay layer as a critical security boundary. Relying on upstream servers to handle authentication is insufficient if the proxy does not validate the request before transmission. Governance of these relay points is required for enterprise LLM integrations.