LiteLLM MCP Authentication Bypass: Patch Now
A LiteLLM MCP authentication bypass, CVE-2026-59822 (CVSS 8.8), lets an attacker skip OAuth2 login entirely when connecting to Model Context Protocol servers through LiteLLM’s proxy, gaining whatever access an authenticated session would carry. CISA added the flaw to its Known Exploited Vulnerabilities catalog on September 2, the first MCP-related vulnerability ever listed there; WatchTowr reports exploitation activity beginning around September 1. A fix has existed since LiteLLM v1.84.0, released May 14.
What Happened
LiteLLM’s proxy includes an OAuth2 passthrough mode for MCP server connections, designed to forward a client’s own authentication through to the downstream MCP server rather than re-authenticating separately. Under specific configurations, a fallback path in that passthrough logic accepts the connection even when OAuth2 validation fails or is skipped, treating it as authenticated regardless. Because MCP servers are commonly wired into internal tools, data sources, and other agents, a bypass at this layer hands an attacker whatever access the MCP integration itself exposes, without presenting any valid credentials.
The LiteLLM MCP authentication bypass affects proxy deployments running OAuth2 passthrough mode on versions prior to 1.84.0. CISA’s federal remediation deadline for this vulnerability is today, September 16.
Why It Matters
MCP has become the connective tissue a growing share of DACH Mittelstand AI deployments use to link LLM applications to internal systems: ticketing platforms, databases, file stores, and other agents. Whatever access an MCP integration carries is exactly what an authentication bypass at the proxy layer hands over. As the first MCP-specific flaw added to CISA’s KEV catalog, this is also the point at which MCP infrastructure starts accumulating its own exploited-vulnerability track record, not a one-off.
What You Should Do Now
- Upgrade LiteLLM to v1.84.0 or later immediately; the fix has existed since May 14, over four months of exposure.
- Confirm whether OAuth2 passthrough mode is enabled on any MCP server connections in your deployment; if an immediate upgrade is not possible, disabling passthrough is the setting to lock down first.
- Review MCP server access logs since September 1 for connections that completed without valid OAuth2 credentials.
DIESEC Perspective
MCP tooling is maturing quickly, and both the access surface it manages and the assumption that “if it connects, it must be authenticated” deserve explicit scrutiny in any AI-integration risk review, rather than a patch-and-move-on treatment reserved for conventional infrastructure.
Not sure which of your AI deployments route through LiteLLM, or whether OAuth2 passthrough is active anywhere in your MCP configuration? Contact DIESEC for a rapid configuration review and exposure assessment.
Sources: The Hacker News | BleepingComputer
Published: 2026-09-18 | Category: Vulnerabilities & Patches | ~4 min read
