Unauthenticated MCP session establishment via arbitrary Bearer token in LiteLLM Streamable HTTP endpoint (CVE-2026-59822)
CISA placed this flaw in KEV on 2026-09-02 following Wiz honeypot observations of attacks against LiteLLM, and any exposed LiteLLM proxy below 1.84.0 lets an unauthenticated caller open an authenticated MCP session with an arbitrary Bearer token.
LiteLLM versions before 1.84.0 fail to properly validate credentials on the MCP Streamable HTTP endpoint, so an attacker who presents any Bearer token can establish an authenticated MCP session. This gives unauthenticated access to the tools and data exposed through the proxy's MCP integration.
Affected: BerriAI litellm < 1.84.0
How to Test
Check the running LiteLLM version (`pip show litellm` or the container image tag); anything below 1.84.0 is affected. Confirm whether the MCP Streamable HTTP endpoint is enabled and reachable from untrusted networks. Review proxy access logs for MCP session requests carrying Bearer tokens that do not correspond to any issued key.
How to Patch
Upgrade LiteLLM to 1.84.0 or later (release https://github.com/BerriAI/litellm/releases/tag/v1.84.0, fix in PR 26463). If you cannot upgrade immediately, block external access to the MCP Streamable HTTP endpoint at the network or reverse-proxy layer, or disable the MCP integration, and rotate any credentials reachable through MCP tools.