CVE-2026-59822: BerriAI LiteLLM authentication bypass in MCP endpoint

CVE-2026-59822 · Severity: critical · CVSS 4 · Exploited in the wild · Published 2026-07-08

BerriAI LiteLLM is a library that provides interfaces to large language model APIs. The MCP (Model Context Protocol) Streamable HTTP endpoint in LiteLLM fails to properly validate authentication tokens, allowing an attacker without valid credentials to bypass authentication and establish an authenticated session. An attacker exploiting this could gain unauthorized access to language model capabilities and potentially sensitive data or operations.

Technologies: Berriai LiteLLM, litellm (PyPI). Vendors: Berriai, PyPI.

Quick answers

Is CVE-2026-59822 exploited in the wild?
Yes. CVE-2026-59822 is known to be exploited in the wild, first recorded on 2 September 2026. Treat it as urgent.
How severe is CVE-2026-59822?
Critical severity, with a CVSS score of 4, published 8 July 2026.
Which products and versions are affected?
Berriai LiteLLM < 1.84.0; litellm (PyPI) ECOSYSTEM:introduced=0,fixed=1.84.0.
Is there a fix for CVE-2026-59822?
Yes. litellm (PyPI): upgrade to 1.84.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-59822 attacked?
It is attacked over the network.
Am I affected by CVE-2026-59822?
Check whether you run Berriai LiteLLM or litellm (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • litellm (PyPI): upgrade to 1.84.0 or later
    pip install "litellm>=1.84.0"

Technical details

The vulnerability is an authentication bypass in the MCP Streamable HTTP endpoint of BerriAI LiteLLM. The endpoint does not properly validate Bearer tokens, allowing an attacker to provide an arbitrary token and establish an authenticated session without valid credentials. The attack requires network access to the HTTP endpoint and does not require prior authentication or user interaction. An attacker can exploit this to gain unauthorized access to MCP functionality, potentially enabling unauthorized API calls, data access, or other malicious operations. The vulnerability is actively being exploited in the wild, indicating public availability of exploit code or techniques.

Affected products

  • BerriAI LiteLLM

Identifiers

  • CVE-2026-59822
  • GHSA-7488-6r32-c95q
  • PYSEC-2026-3479

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.