---
id: CVE-2026-59822
title: >-
  LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native)
  format
summary: >-
  LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native)
  format. Prior to 1.84.0, LiteLLM's MCP Streamable HTTP endpoint allowed an
  unauthenticated attacker to use a fabricated Authorization header to trigger
  an OAut…
severity: high
cvss: 8.2
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N'
cwe:
  - CWE-287
  - CWE-306
vendor: litellm
product: litellm
affected:
  - litellm < 1.84.0
patched:
  - litellm 1.84.0
published: '2026-07-08'
updated: '2026-07-13'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-59822'
references:
  - url: >-
      https://github.com/BerriAI/litellm/commit/73869f0faf7d11ee21adcb5f91b8c33a340b6c2c
    label: security-advisories@github.com
  - url: 'https://github.com/BerriAI/litellm/pull/26463'
    label: security-advisories@github.com
  - url: 'https://github.com/BerriAI/litellm/releases/tag/v1.84.0'
    label: security-advisories@github.com
  - url: 'https://github.com/BerriAI/litellm/security/advisories/GHSA-7488-6r32-c95q'
    label: security-advisories@github.com
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-59822'
  - url: 'https://github.com/BerriAI/litellm'
tags:
  - nvd
  - kev
  - in-the-wild
  - exploit-available
  - osv
  - pip
epss: 0.0087
epssPercentile: 0.56786
ingestedAt: '2026-07-13T14:27:26.930Z'
kev: true
exploited: true
kevDateAdded: '2026-09-02'
kevDueDate: '2026-09-16'
kevRansomware: false
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/HORKimhab/CVE-2026-59822'
  checkedAt: '2026-09-21T15:29:50.676Z'
exploitAvailable: true
aliases:
  - GHSA-7488-6r32-c95q
  - PYSEC-2026-3479
ecosystem: pip
---

## Overview

LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.84.0, LiteLLM's MCP Streamable HTTP endpoint allowed an unauthenticated attacker to use a fabricated Authorization header to trigger an OAuth2 passthrough fallback path that replaced failed LiteLLM key validation with an empty UserAPIKeyAuth() object, allowing requests to reach MCP tooling without a valid LiteLLM key. This issue is fixed in version 1.84.0.

## Affected

- `litellm < 1.84.0`

## Remediation

Upgrade past the affected range:

- `litellm 1.84.0`

## Package advisory (CVE-2026-59822)

Affected packages:

- `litellm < 1.84.0`

Patched in:

- `litellm 1.84.0`

Source: https://osv.dev/vulnerability/GHSA-7488-6r32-c95q