Executive brief
BerriAI LiteLLM is a library that provides interfaces to large language model APIs. The MCP (Model Context Protocol) Streamable HTTP endpoint in LiteLLM fails to properly validate authentication tokens, allowing an attacker without valid credentials to bypass authentication and establish an authenticated session. An attacker exploiting this could gain unauthorized access to language model capabilities and potentially sensitive data or operations.
Technical details
The vulnerability is an authentication bypass in the MCP Streamable HTTP endpoint of BerriAI LiteLLM. The endpoint does not properly validate Bearer tokens, allowing an attacker to provide an arbitrary token and establish an authenticated session without valid credentials. The attack requires network access to the HTTP endpoint and does not require prior authentication or user interaction. An attacker can exploit this to gain unauthorized access to MCP functionality, potentially enabling unauthorized API calls, data access, or other malicious operations. The vulnerability is actively being exploited in the wild, indicating public availability of exploit code or techniques.
Affected products
- BerriAI LiteLLM