---
schema_version: '1.0'
id: security-20260723-9fd6c7
url: https://osv.dev/vulnerability/GHSA-7488-6r32-c95q
url_hash: 9fd6c79c1ff7295316cda0c97b0340145f4581acce1fb0e2e243c5476b54138f
canonical_url: https://osv.dev/vulnerability/GHSA-7488-6r32-c95q
source: osv:ghsa
category: security/library
category_raw: cve/library
region: null
tags:
- cve
- CVE-2026-59822
- GHSA-7488-6r32-c95q
- severity:CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
- litellm
- PyPI
lang: en
published_at: '2026-07-22T22:38:33Z'
fetched_at: '2026-07-23T06:59:45.013415Z'
updated_at: '2026-07-23T06:59:55Z'
status: published
content_hash: 627890025609109835f6488fa537e2c5ed53f131a8bcf5b57feae28c6440d45c
content_changed_at: null
license_note: full
summary: 'LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback'
summary_source: rss
summary_en: 'LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback'
entities:
- name: MCP(Model Context Protocol
  type: concept
- name: Herme's Dashboard Basic Authentication User
  type: person
key_facts: []
related: []
related_auto:
- name: Herme's Dashboard Basic Authentication Password
  type: person
  weight: 2.0
- name: AIエージェント
  type: person
  weight: 1.0
- name: Administrative area
  type: UNKNOWN
  weight: 1.0
title: 'CVE-2026-59822: LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough
  Fallback'
---

# CVE-2026-59822: LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback

## TL;DR
LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback

## Key Points
- cve / CVE-2026-59822 / GHSA-7488-6r32-c95q / severity:CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N / litellm / PyPI

## Details
**Severity:** CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
**Advisory:** GHSA-7488-6r32-c95q (CVE-2026-59822)

**Affected (your watchlist):**
- `PyPI:litellm` 1.72.6.post2 → fixed in 1.84.0 [docker/docker-strands]

**Details:**
### Impact

LiteLLM's MCP Streamable HTTP endpoint could allow an unauthenticated attacker to establish an authenticated MCP session using an arbitrary Bearer token.

The MCP auth handler supported OAuth2 passthrough for upstream MCP servers, but the fallback path could replace failed LiteLLM key validation with an empty `UserAPIKeyAuth()` object. This allowed requests with a fabricated `Authorization` header to reach MCP tooling without a valid LiteLLM key.

An attacker could use this to list and call configured MCP tools and access connected services exposed through MCP.

### Patches

The issue is fixed in `1.84.0`.

We recommend upgrading to `1.84.0` or later.

### Workarounds

If upgrading is not immediately possible, disable MCP routes or block access to `/mcp/` and related MCP endpoints at your reverse proxy or API gateway.

### References

* [v1.84.0](https://github.com/BerriAI/litellm/releases/tag/v1.84.0)

**References:**
- https://github.com/BerriAI/litellm/security/advisories/GHSA-7488-6r32-c95q
- https://nvd.nist.gov/vuln/detail/CVE-2026-59822
- https://github.com/BerriAI/litellm/pull/26463
- https://github.com/BerriAI/litellm/commit/73869f0faf7d11ee21adcb5f91b8c33a340b6c2c
- https://github.com/BerriAI/litellm
- https://github.com/BerriAI/litellm/releases/tag/v1.84.0

_Data: OSV.dev (upstream: ghsa) — https://osv.dev/vulnerability/GHSA-7488-6r32-c95q_

## Source
元記事: [CVE-2026-59822: LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback](https://osv.dev/vulnerability/GHSA-7488-6r32-c95q) — published 2026-07-22T22:38:33Z