threat/intelligence
Active exploitationCISA KEVThreat level: HighHIGH

CVE-2026-59822BerriAI LiteLLM MCP authentication bypass (CVE-2026-59822) in CISA KEV

By Norbert Hofmann, Cyber Defense Analyst · Updated · Revision 1

Executive summary

CVE-2026-59822 is an improper authentication flaw (CWE-287, CWE-306) in the MCP Streamable HTTP endpoint of the LiteLLM proxy (AI gateway). In versions before 1.84.0, a failed LiteLLM key check in the OAuth2 passthrough fallback was replaced by an empty UserAPIKeyAuth() object, so a request with any fabricated Authorization: Bearer header reached MCP tooling without a valid key. The vendor advisory GHSA-7488-6r32-c95q rates it High (CVSS 4.0 8.8). It is fixed in 1.84.0.

Wiz Research, which discovered the flaw, observed exploitation in its honeypot on 2026-07-07, and CISA added the CVE to the KEV catalog on 2026-09-02 (due date 2026-09-16) in a batch of seven flaws. The reverse shells, crypto mining and LLM API key theft reported around that batch are tied to other CVEs (Kestra, Switchvox, and the LiteLLM CVE-2026-42271 / Starlette CVE-2026-48710 chain), not directly to CVE-2026-59822.

Defenders should treat a LiteLLM gateway as a Tier-0 secrets store: patch, block MCP routes from untrusted networks, and if an unpatched gateway was exposed, review MCP tool activity and rotate the master key, provider API keys, virtual keys and credentials of MCP-connected services.

Threat assessment

By itself, the bypass grants access to the MCP tools the proxy brokers: an attacker can list and call configured MCP tools and reach connected services (per the advisory; Wiz names examples such as databases, Jira, Slack and CI/CD). The advisory rates confidentiality impact High and integrity Low. Corgea notes the bypass does not by itself grant code execution on the host. Impact therefore depends heavily on which MCP servers are configured and what credentials they hold.

LiteLLM gateways are being actively targeted as a class. CISA KEV lists three LiteLLM CVEs (CVE-2026-42208 SQL injection, added 2026-05-08; CVE-2026-42271 command injection, added 2026-06-08; CVE-2026-59822, added 2026-09-02). Microsoft (2026-08-26) documented attacks on LiteLLM gateways, linked by public research to the CVE-2026-42271 / CVE-2026-48710 chain, that harvested model-provider API keys, the master key and database connection strings from the process environment, dumped LiteLLM_ProxyModelTable and LiteLLM_VerificationToken from PostgreSQL, and deployed XMRig-like miners. Wiz reports that 294 of 3,074 public instances it tested in February 2026 accepted the default master key sk-1234.

For SOC prioritisation: any internet-reachable LiteLLM proxy below 1.84.0 with MCP enabled should be treated as potentially accessed. Because co-located LiteLLM flaws lead to full secret compromise, exposed gateways that were also below the fixed versions of CVE-2026-42271 or CVE-2026-59821 warrant a full compromise assessment.

Timeline

  1. Wiz publishes "Off Guard" research on LiteLLM, including the CVE-2026-59822 MCP bypass and default master key exposure. Source

  2. CISA adds CVE-2026-59822 to the KEV catalog (due 2026-09-16) together with SonicWall SMA1000, Kestra, JFrog, Starlette and Switchvox flaws. Source

  3. Wiz reports honeypot exploitation of CVE-2026-59822 and separate LiteLLM cryptomining via CVE-2026-42271. Source

  4. Microsoft documents attacks on LiteLLM gateways (CVE-2026-42271 / CVE-2026-48710 context) harvesting provider keys and deploying miners. Source

  5. CVE-2026-59822 published (CVSS 4.0 8.8, CWE-287/CWE-306). Source

  6. Wiz observes exploitation of the MCP bypass in its honeypot. Source

  7. BerriAI publishes advisory GHSA-7488-6r32-c95q; patched version 1.84.0. Source

  8. Related LiteLLM command injection CVE-2026-42271 added to CISA KEV. Source

  9. LiteLLM 1.84.0 with the MCP bypass fix released, according to the Wiz disclosure timeline. Source

Affected & exposure

BerriAI LiteLLM (PyPI package litellm and proxy/gateway deployments) versions before 1.84.0

Exposure requires reachable MCP Streamable HTTP routes (for example /mcp/{server} or /{server}/mcp, per Corgea)

The fix (PR #26463) only permits the OAuth2 fallback when every target MCP server is configured with auth_type oauth2

Exploitation in the wild

Wiz Research observed exploitation of CVE-2026-59822 in its honeypot on 2026-07-07; the honeypot requests used single-character Bearer tokens to probe model enumeration endpoints.

CISA added CVE-2026-59822 to the KEV catalog on 2026-09-02 with a due date of 2026-09-16; knownRansomwareCampaignUse is "Unknown".

No IOCs specific to CVE-2026-59822 have been published. IOCs in the Wiz and Microsoft posts belong to CVE-2026-42271-related LiteLLM campaigns (cryptomining, secret harvesting) and should not be attributed to this CVE.

Wiz notes the bypass formed part of a chain with CVE-2026-59821 (post-auth RCE via custom code guardrails, fixed in 1.82.0).

Detection & hunting

The vendor and researchers have not published log signatures for CVE-2026-59822. Corgea recommends reviewing MCP-path requests where bearer authentication failed followed by successful MCP tool enumeration or invocation. Host-level hunting should follow Microsoft's documented post-exploitation artefacts for LiteLLM gateways (gateway process spawning shells or downloaders, access to /proc/1/environ, config and secret discovery), which apply to related LiteLLM attacks. Queries are generic starting points and need tuning to local log schemas.

Splunk SPL · External requests to LiteLLM MCP routes via reverse proxy logs

Hunting starting point, not lab-tested. Map index, table and field names to your environment before use.

index=proxy OR index=web host=*litellm* earliest=-90d
| where match(uri_path, "(^/mcp(/|$))|(/mcp/?$)")
| where NOT cidrmatch("10.0.0.0/8", clientip) AND NOT cidrmatch("172.16.0.0/12", clientip) AND NOT cidrmatch("192.168.0.0/16", clientip)
| stats count, values(status) AS statuses, values(method) AS methods, dc(uri_path) AS paths, earliest(_time) AS first_seen, latest(_time) AS last_seen BY clientip, http_user_agent
| convert ctime(first_seen) ctime(last_seen)
| sort - count
``` Any successful (2xx) MCP traffic from untrusted sources before the upgrade to 1.84.0 warrants review ```
KQL · LiteLLM gateway process spawning shells, downloaders or reading process environment

Hunting starting point, not lab-tested. Map index, table and field names to your environment before use.

DeviceProcessEvents
| where Timestamp > ago(90d)
| where InitiatingProcessCommandLine has_any ("litellm", "proxy_server")
| where FileName in~ ("sh", "bash", "dash", "curl", "wget", "python", "python3", "base64", "crontab", "chattr", "modprobe")
   or ProcessCommandLine has_any ("/proc/1/environ", "DATABASE_URL", "LITELLM_MASTER_KEY", "authorized_keys")
| project Timestamp, DeviceName, AccountName, InitiatingProcessCommandLine, FileName, ProcessCommandLine
| order by Timestamp desc
Sigma · Access to LiteLLM configuration and secret files

Hunting starting point, not lab-tested. Map index, table and field names to your environment before use.

title: Suspicious Access to LiteLLM Configuration or Secret Files
status: experimental
description: Detects command lines referencing LiteLLM config and env file paths enumerated by attackers against LiteLLM gateways (documented by Wiz). Related to post-exploitation of LiteLLM gateways, including after CVE-2026-59822 / CVE-2026-42271.
references:
  - https://www.wiz.io/blog/ai-infrastructure-honeypot
  - https://www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points/
logsource:
  product: linux
  category: process_creation
detection:
  selection:
    CommandLine|contains:
      - 'litellm_config.yaml'
      - '/etc/litellm/.env'
      - '.litellm/config.yaml'
      - '/proc/1/environ'
  condition: selection
falsepositives:
  - Administrators inspecting configuration during maintenance
level: high
tags:
  - attack.credential-access
  - attack.t1552.001

Mitigation

  • Upgrade LiteLLM to 1.84.0 or later (fix: PR #26463, commit 73869f0). Also verify you are past the fixed versions of the other KEV-listed LiteLLM flaws (CVE-2026-42271, CVE-2026-42208) and CVE-2026-59821 (fixed in 1.82.0).
  • Workaround per vendor: disable MCP routes or block /mcp/ and related MCP endpoints at the reverse proxy or API gateway until patched.
  • Keep LiteLLM API, Admin UI and MCP surfaces off the internet; require authentication and restrict admin ports (Microsoft).
  • Replace the default master key sk-1234 with a strong unique value (Wiz). Rotating the master key also signs all users out of the Admin UI.
  • If an unpatched gateway was reachable: rotate every model-provider API key configured on the proxy (OpenAI, Anthropic, Azure, Gemini etc.) at the provider side, since these are the main target of LLMjacking; review provider billing/usage for anomalies.
  • Rotate the LiteLLM master key following the vendor procedure: if LITELLM_SALT_KEY is set, only change the master key and restart all instances (do not call /key/regenerate with new_master_key); if no salt key is set, back up the database and re-encrypt via /key/regenerate or LITELLM_MIGRATE_FROM_MASTER_KEY. Do not change LITELLM_SALT_KEY itself; per vendor docs there is no in-place migration for it, so if it is suspected compromised, plan to re-register all stored credentials.
  • Regenerate or revoke proxy-issued virtual keys (LiteLLM_VerificationToken) and rotate database credentials (DATABASE_URL), UI credentials and cloud IAM credentials used by the gateway host.
  • Rotate credentials of every MCP-connected service (ticketing, source control, CI/CD, databases, chat) and review their audit logs for actions performed via the gateway.
  • Store upstream API keys in a managed secret store instead of environment variables, issue per-team virtual keys with spend limits, apply deny-by-default egress and run the proxy under a dedicated low-privilege service account (Microsoft).

Update log

DateChange
2026-11-09Initial publication.

Sources

  1. GHSA-7488-6r32-c95q: MCP Authentication Bypass via OAuth2 Passthrough Fallback
  2. CVE-2026-59822 record (CVE List V5)
  3. CISA Known Exploited Vulnerabilities catalog (cisagov/kev-data mirror)
  4. LiteLLM release v1.84.0
  5. LiteLLM PR #26463: tighten public-route detection and OAuth2 fallback gating
  6. LiteLLM docs: Master key rotations
  7. Wiz: Off Guard - Breaking LiteLLM from authentication bypass to cloud compromise
  8. Wiz: AI infrastructure honeypot findings
  9. Microsoft: When AI infrastructure becomes the target - securing gateways and control points
  10. The Hacker News: CISA adds seven exploited flaws