LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.84.0, LiteLLM's MCP Streamable HTTP endpoint allowed an unauthenticated attacker to use a fabricated Authorization header to trigger an OAuth2 passthrough fallback path that replaced failed LiteLLM key validation with an empty UserAPIKeyAuth() object, allowing requests to reach MCP tooling without a valid LiteLLM key. This issue is fixed in version 1.84.0.

According to its self-reported version, the instance of LiteLLM running on the remote web server is prior to 1.84.0. It is, therefore, affected by multiple vulnerabilities :

- An Authentication Bypass through OAuth2 Passthrough Fallback (CVE-2026-59822).

- An Authentication Bypass via Host Header Injection (CVE-2026-49468).

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.84.0,
    LiteLLM's MCP Streamable HTTP endpoint allowed an unauthenticated attacker to use a fabricated
    Authorization header to trigger an OAuth2 passthrough fallback path that replaced failed LiteLLM key
    validation with an empty UserAPIKeyAuth() object, allowing requests to reach MCP tooling without a valid
    LiteLLM key. This issue is fixed in version 1.84.0. (CVE-2026-59822)

ID	Name	Product	Family	Type	Severity
115466	LiteLLM < 1.84.0 Multiple Vulnerabilities	Web App Scanning	Artificial Intelligence	Version Based	critical
445187	SCA: security update for litellm (GHSA-7488-6r32-c95q)	Tenable Cloud Security	SCA Checks	Local	high
445187	SCA: security update for litellm (GHSA-7488-6r32-c95q)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2026-59822

high

Tenable Plugins

critical

high

high