The Relay Has No Lock: LiteLLM's MCP Auth Bypass Marks a First for the CISA KEV Catalog

CVE-2026-59822 is a critical LiteLLM authentication flaw (CVSS 8.8) where an OAuth2 passthrough fallback allowed a fabricated Authorization Bearer to bypass validation, enabling unauthenticated attackers to list and execute configured MCP tools and access connected services. CISA added the issue to the KEV on September 2, 2026; versions prior to 1.84.0 were patched in v1.84.0 on May 14, 2026, and organizations are expected to remediate within 2–3 weeks under BOD 22-01 or disable /mcp/ endpoints, highlighting important protocol security and trust risks for enterprise LLM adoption and integration.

See what traders are focused on

Mechanism: The OAuth2 Passthrough Fallback

The vulnerability, tracked as CVE-2026-59822 , originates in the authentication handler for the Model Context Protocol (MCP) within LiteLLM. LiteLLM serves as a proxy layer between enterprise applications and various LLM providers. The flaw exists in how the system manages authentication for upstream MCP servers.

When LiteLLM attempts to validate an incoming API key, a failure in the validation process triggers a fallback mechanism intended to support OAuth2 passthrough. Instead of rejecting the request when key validation fails, the system substitutes an empty UserAPIKeyAuth() object. This logic error allows a request containing a fabricated Authorization Bearer header to bypass standard security checks and reach the underlying MCP tooling. The vulnerability carries a CVSS score of 8.8 , reflecting high severity due to the ease of exploitation and the potential for unauthorized access.

MCP Context: A First for the KEV Catalog

On September 2, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog . It is the first MCP-related flaw to appear in the KEV. Under Binding Operational Directive 22-01, federal agencies are typically expected to remediate such vulnerabilities within two to three weeks of their addition to the catalog.

Impact: Unauthenticated Access to Tooling

An unauthenticated remote attacker can leverage the bypass to interact with configured MCP tools. This access allows an attacker to list available tools and execute them, potentially gaining unauthorized access to connected services exposed through the MCP interface. Because LiteLLM acts as a central relay, the scope of this exposure is limited only by the tools and services connected to the proxy.

There is currently no evidence of public exploitation. No functional proof-of-concept exploit script has been published, and no active campaigns have been confirmed.

The vulnerability affects all LiteLLM versions prior to 1.84.0 . The maintainers released a patch in version 1.84.0 on May 14, 2026. This fix modifies the authentication logic to ensure that the OAuth2 passthrough fallback only executes when every targeted server is explicitly configured by an operator with auth_type=oauth2. For organizations unable to update immediately, the recommended workaround is to disable MCP routes or block access to /mcp/ endpoints entirely.

Implications for MCP Trust Architecture

CVE-2026-59822 demonstrates that the LiteLLM proxy failed to enforce strict authentication, allowing a fabricated Bearer token to reach MCP tooling. As noted in coverage of MCP Governance Surface and MCP Platform Battleground, the protocol relies on intermediary layers for security. Security professionals must treat the relay layer as a critical security boundary. Relying on upstream servers to handle authentication is insufficient if the proxy does not validate the request before transmission. Governance of these relay points is required for enterprise LLM integrations.

When the Management Plane Becomes the Door: Cisco ISE Auth Bypass Hits CVSS 10.0 as Federal Deadline Expires

The Master Key Turns Against Itself: Check Point’s Fifth Critical Management-Plane Flaw in Two Months