BerriAI LiteLLM Authentication Bypass (CVE-2026-59822) Enables Unauthenticated Access

A critical authentication bypass in BerriAI LiteLLM allows unauthenticated remote attackers to establish authorized sessions within Model Context Protocol (MCP) environments. Tracked as CVE-2026-59822, this BerriAI LiteLLM vulnerability resides in the application’s MCP Streamable HTTP endpoint, where presentation of any arbitrary string within a Bearer token header is accepted as valid authentication.

How Any Bearer Token Unlocks MCP Sessions

LiteLLM acts as an enterprise proxy and routing layer for large language model (LLM) APIs, standardizing calls, tracking costs, and managing connected tools across platforms. As part of its integration with Anthropic’s Model Context Protocol (MCP)—which connects LLMs to enterprise databases, internal APIs, and context servers—LiteLLM exposes a streamable HTTP transport endpoint for session management.

The vulnerability stems from improper authentication logic (CWE-287 / CWE-306) in the handler managing stream setup requests. When a client submits an HTTP request containing an Authorization: Bearer <token> header, the endpoint verifies the presence of the header structure but fails to validate the token string against LiteLLM’s active key inventory or user database. As long as a Bearer token string is supplied, the application grants full access to the requested MCP session.

Realistic Attack Paths and Risk Profile

The vulnerability carries a CVSS 3.1 base score of 8.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N). The metrics highlight an easily exploitable attack surface: it is remotely reachable over the network, requires zero initial privileges, involves low attack complexity, and needs no user interaction.

Because LLM gateways sit directly between internal enterprise context repositories and upstream AI vendors, compromising the MCP transport layer provides significant reach:

• Confidentiality Impact (High): An attacker can tap into active MCP streams to capture sensitive business data, database queries, proprietary context chunks, and user prompts passed through the gateway.
• Integrity Impact (Low): Depending on the capabilities exposed to the specific MCP stream, an attacker may be able to send arbitrary inputs or trigger contextual tool invocations managed by the proxy.

While current exploitation metrics place probability at 0.52% (41.9th percentile), automated scanning against public AI gateway infrastructure is escalating rapidly. Internet-facing deployments of LiteLLM configured with MCP enabled are at immediate risk of automated discovery.

Remediation Strategy

To resolve CVE-2026-59822, upgrade LiteLLM to version 1.84.0 or higher. The update (implemented in commit 73869f0faf7d11ee21adcb5f91b8c33a340b6c2c) enforces strict token validation against LiteLLM’s internal authentication framework prior to establishing the HTTP stream session.

If upgrading cannot be completed immediately, restrict access to the /mcp HTTP stream endpoints using your ingress controller, web application firewall, or network ACLs to block untrusted external traffic. Organizations aligned with CISA BOD 26-04 requirements should ensure patches are deployed across exposed instances prior to the September 16, 2026 deadline.