LiteLLM's MCP Auth-Bypass Flaw Lands on CISA's KEV: What It Means for AI Gateway Teams

Daniel Reyes Principal Engineer (AI/ML), YuSMP Group · Builds and secures LLM and agent infrastructure for US and EU teams

The short version

What CVE-2026-59822 actually does

LiteLLM, from BerriAI, is one of the most widely deployed open-source AI gateways: a proxy that gives teams a single OpenAI-compatible API in front of dozens of model providers, with key management, budgets, routing and logging in one place. Newer versions also speak the Model Context Protocol (MCP), the emerging standard for letting an LLM call external tools and data sources. CVE-2026-59822 lives at exactly that junction — the MCP Streamable HTTP endpoint — and it is rated 8.8 (high) on CVSS.

The mechanics are a textbook authentication-fallback bug. In LiteLLM releases before 1.84.0, a request to the MCP endpoint carrying a fabricated Authorization header would fail the normal LiteLLM key validation, but instead of being rejected, it fell through to an OAuth2 passthrough path. That path replaced the failed check with an empty authenticated-user object, so the request was treated as valid and allowed to continue. The result: an unauthenticated caller, presenting nothing more than an arbitrary Bearer token, could establish an authenticated MCP session. From there an attacker can enumerate the MCP tools the gateway exposes, call them, and reach whatever downstream services those tools are wired into.

CISA does not add flaws to the Known Exploited Vulnerabilities catalog on theory — the bar is evidence of active exploitation in the wild. CVE-2026-59822 was one of seven vulnerabilities added in early September 2026, with a remediation deadline of September 16 for US federal civilian agencies. What makes the batch notable is its composition: three of the seven additions targeted AI infrastructure rather than the usual VPNs, mail servers and web apps. That is the signal worth reading twice. AI plumbing has become a routine category of exploited infrastructure, and a hard patch deadline on a private-sector team's LLM gateway is the practical consequence.

Why the AI gateway is the target

It is tempting to file this under "another CVE" and move on, but the location matters more than the mechanism. An AI gateway is not a leaf service; it is a chokepoint that concentrates power. To do its job it stores the API keys for every model provider behind it, holds the budgets and routing rules for the whole organization, and — once MCP is enabled — brokers access to the tools and data sources the models are allowed to touch. Compromise the gateway and you have not popped one app; you have reached the credentials and the tool surface of everything that runs through it.

MCP sharpens the point. The protocol exists so that an LLM can list and invoke tools — a database query tool, an internal API client, a file reader — and each of those tools is a door into a real system. An authentication bypass on the MCP endpoint therefore is not "an attacker can chat with your model." It is "an attacker can call the tools your model can call," with whatever permissions those tools were granted. For teams building AI agents, that is the whole ballgame: the tool layer is where an agent's real-world capability — and its blast radius — lives. A flaw that hands that layer to an unauthenticated caller is closer to a stolen service account than to a leaked prompt.

What it means for US & EU teams

First, find out whether you are running LiteLLM at all, and at what version. Because it is so easy to stand up, an LLM gateway often arrives without a formal owner — a proof-of-concept a data-science team spun up, a container in a platform namespace, a dependency inside a larger AI product. Any deployment on a release before 1.84.0 that exposes the MCP endpoint is in scope. Upgrade to 1.84.0 or later, and confirm it the way you would confirm any KEV item: with an inventory, not a hope. The September 16 federal deadline is a reasonable internal target even if you have no compliance obligation to it.

Second, stop treating the AI gateway as a convenience and start treating it as infrastructure. MCP and administrative endpoints should not be reachable from untrusted networks, and they should sit behind real authentication and network controls rather than relying on the gateway's own key check as the only gate — this flaw is a reminder that a single in-app check can fail open. Apply least privilege to every MCP tool connection so that even a successful bypass reaches as little as possible, and rotate the provider keys the gateway stores if you cannot rule out exposure. In regulated contexts — a FinTech or HealthTech product where the gateway's tools touch customer data — an unauthenticated path to that tooling is the kind of finding that turns into a reportable incident.

Third, put AI infrastructure on the same patch cadence as the rest of your stack. The lesson of a batch where three of seven KEV additions were AI components is that gateways, orchestration servers and agent frameworks are now attacked like any other exposed service. Keeping LiteLLM (and its peers) one or two releases behind head rather than years behind, and wiring their versions into your vulnerability-management process, turns the next AI-infrastructure CVE into a routine bump instead of a scramble.

A checklist for this week

1. Inventory your gateways. Find every LiteLLM deployment — including shadow ones in PoCs and platform namespaces — and record its version and owner.
2. Upgrade to 1.84.0+. Patch anything on an earlier release that exposes the MCP Streamable HTTP endpoint, and verify against the September 16 deadline.
3. Close the endpoint off. Put MCP and admin endpoints behind network controls and strong auth; do not expose them to untrusted networks.
4. Least-privilege the tools. Review what each connected MCP tool can reach and cut it to the minimum so a bypass yields as little as possible.
5. Rotate and review. Rotate the provider API keys the gateway stores if exposure can't be ruled out, and check logs for malformed-Authorization requests hitting the MCP route.
6. Add AI infra to the cadence. Track gateway and framework versions in vulnerability management so the next AI-infrastructure CVE is routine.

Frequently asked questions

Sources

CISA — Known Exploited Vulnerabilities Catalog (primary source, addition early September 2026)
The Hacker News — CISA Adds Seven Exploited Flaws as Attackers Deploy Reverse Shells and Crypto Miners (September 2026)
GitLab Advisory Database — CVE-2026-59822: LiteLLM MCP Authentication Bypass via OAuth2 Passthrough Fallback