https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T16:16:44.231552+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-59822 CVE-2026-59822 — LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback 2026-10-06T16:16:44.233176+00:00

Affected: BerriAI litellm

LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.84.0, LiteLLM's MCP Streamable HTTP endpoint allowed an unauthenticated attacker to use a fabricated Authorization header to trigger an OAuth2 passthrough fallback path that replaced failed LiteLLM key validation with an empty UserAPIKeyAuth() object, allowing requests to reach MCP tooling without a valid LiteLLM key. This issue is fixed in version 1.84.0.