Description
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.84.0, LiteLLM's MCP Streamable HTTP endpoint allowed an unauthenticated attacker to use a fabricated Authorization header to trigger an OAuth2 passthrough fallback path that replaced failed LiteLLM key validation with an empty UserAPIKeyAuth() object, allowing requests to reach MCP tooling without a valid LiteLLM key. This issue is fixed in version 1.84.0.
Published: 2026-07-08
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

LiteLLM is an AI gateway that proxies requests to large language model APIs. In earlier releases, its MCP Streamable endpoint performed OAuth2 authentication through a passthrough fallback. An attacker can craft an HTTP request with a fabricated Authorization header that triggers this fallback UserAPIKeyAuth object. The empty object bypasses the normal LiteLLM key check, allowing the request to reach MCP tooling without a valid key. The vulnerability stems from authentication weaknesses, identified as CWE-287 and CWE-306.

Affected Systems

All installations of BerriAI:litellm running a version older than v1.84.0 are affected, as the MCP Streamable logic remains unchanged up to that release.

Risk and Exploitability

The CVSS score of 8.8 classifies the flaw as high severity. The EPSS figure of less than 1% indicates a low probability of exploitation, and the vulnerability is not listed in CISA's KEV catalog. Nevertheless, an unauthenticated attacker who can reach the MCP Streamable endpoint can trigger the flaw and invoke internal MCP functions normally gated by a valid LiteLLM key.

Generated by OpenCVE AI on July 26, 2026 at 17:19 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade LiteLLM to version 1.84.0 or newer, which removes the OAuth2 passthrough fallback.
  • If upgrading is impossible at the moment, restrict external access to the MCP Streamable endpoint or enforce a strict API key policy.
  • Apply network segmentation or firewall rules to isolate the MCP tooling from untrusted networks.

Generated by OpenCVE AI on July 26, 2026 at 17:19 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-7488-6r32-c95q LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback
History

Thu, 09 Jul 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 08 Jul 2026 20:45:00 +0000

Type Values Removed Values Added
First Time appeared Berriai
Berriai litellm
Vendors & Products Berriai
Berriai litellm

Wed, 08 Jul 2026 19:45:00 +0000

Type Values Removed Values Added
Description LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.84.0, LiteLLM's MCP Streamable HTTP endpoint allowed an unauthenticated attacker to use a fabricated Authorization header to trigger an OAuth2 passthrough fallback path that replaced failed LiteLLM key validation with an empty UserAPIKeyAuth() object, allowing requests to reach MCP tooling without a valid LiteLLM key. This issue is fixed in version 1.84.0.
Title LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback
Weaknesses CWE-287
CWE-306
References
Metrics cvssV4_0

{'score': 8.8, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Berriai Litellm
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-07-09T14:31:08.962Z

Reserved: 2026-07-07T15:00:50.978Z

Link: CVE-2026-59822

cve-icon Vulnrichment

Updated: 2026-07-09T14:31:05.564Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-26T17:30:17Z

Weaknesses
  • CWE-287

    Improper Authentication

  • CWE-306

    Missing Authentication for Critical Function