# CVE-2026-59822: BerriAI LiteLLM authentication bypass in MCP endpoint

Source: https://junglewise.ai/threats/cve-2026-59822-berriai-litellm-authentication-bypass-in-mcp-endpoint  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-08. Updated: 2026-09-24  
License: CC BY 4.0 with a link back

CVE-2026-59822 · Severity: critical · CVSS 4 · Exploited in the wild · Published 2026-07-08

BerriAI LiteLLM is a library that provides interfaces to large language model APIs. The MCP (Model Context Protocol) Streamable HTTP endpoint in LiteLLM fails to properly validate authentication tokens, allowing an attacker without valid credentials to bypass authentication and establish an authenticated session. An attacker exploiting this could gain unauthorized access to language model capabilities and potentially sensitive data or operations.

Technologies: [Berriai LiteLLM](https://junglewise.ai/threats/technologies/litellm), [litellm (PyPI)](https://junglewise.ai/threats/technologies/pypi-litellm). Vendors: [Berriai](https://junglewise.ai/threats/vendors/berriai), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-59822 exploited in the wild?** Yes. CVE-2026-59822 is known to be exploited in the wild, first recorded on 2 September 2026. Treat it as urgent.

**How severe is CVE-2026-59822?** Critical severity, with a CVSS score of 4, published 8 July 2026.

**Which products and versions are affected?** Berriai LiteLLM < 1.84.0; litellm (PyPI) ECOSYSTEM:introduced=0,fixed=1.84.0.

**Is there a fix for CVE-2026-59822?** Yes. litellm (PyPI): upgrade to 1.84.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-59822 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-59822?** Check whether you run Berriai LiteLLM or litellm (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- litellm (PyPI): upgrade to 1.84.0 or later

  ```sh
  pip install "litellm>=1.84.0"
  ```


## Technical details

The vulnerability is an authentication bypass in the MCP Streamable HTTP endpoint of BerriAI LiteLLM. The endpoint does not properly validate Bearer tokens, allowing an attacker to provide an arbitrary token and establish an authenticated session without valid credentials. The attack requires network access to the HTTP endpoint and does not require prior authentication or user interaction. An attacker can exploit this to gain unauthorized access to MCP functionality, potentially enabling unauthorized API calls, data access, or other malicious operations. The vulnerability is actively being exploited in the wild, indicating public availability of exploit code or techniques.

## Affected products

- BerriAI LiteLLM

## Identifiers

- CVE-2026-59822
- GHSA-7488-6r32-c95q
- PYSEC-2026-3479

## Related threats

- [LiteLLM arbitrary local file read via vertex_ai_credentials](https://junglewise.ai/threats/litellm-internal-user-viewer-arbitrary-local-file-read-via-vertex-ai-649a7475)
- [LiteLLM reflected XSS in SSO debug callback endpoint](https://junglewise.ai/threats/litellm-vulnerable-to-reflected-xss-in-sso-debug-callback-38154651)
- [LiteLLM proxy authentication bypass via reused crypto context](https://junglewise.ai/threats/cve-2026-114612-litellm-is-a-proxy-server-ai-gateway-to-call-llm-apis-in-openai)
- [BerriAI LiteLLM improper authorization in secret resolution](https://junglewise.ai/threats/cve-2026-108575-a-vulnerability-has-been-found-in-berriai-litellm-up-to-1-94-0)
- [BerriAI LiteLLM authorization bypass in spend tracking](https://junglewise.ai/threats/cve-2026-108574-a-flaw-has-been-found-in-berriai-litellm-up-to-1-95-0-affected)