LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.84.0, LiteLLM's MCP Streamable HTTP endpoint allowed an unauthenticated attacker to use a fabricated Authorization header to trigger an OAuth2 passthrough fallback path that replaced failed LiteLLM key validation with an empty UserAPIKeyAuth() object, allowing requests to reach MCP tooling without a valid LiteLLM key. This issue is fixed in version 1.84.0.

The version of the LiteLLM Python package installed on the remote host is prior to 1.84.0. It is, therefore, affected by a vulnerability:

  - LiteLLM contains an improper authentication vulnerability in the MCP Streamable HTTP endpoint. When     LiteLLM key validation fails, the fallback OAuth2 passthrough path populates the session with an empty     UserAPIKeyAuth() object instead of rejecting the request. An unauthenticated attacker can supply a     fabricated Bearer token to trigger this fallback, establishing an authenticated MCP session and gaining     access to MCP tools and connected services without valid credentials. (CVE-2026-59822)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.84.0,
    LiteLLM's MCP Streamable HTTP endpoint allowed an unauthenticated attacker to use a fabricated
    Authorization header to trigger an OAuth2 passthrough fallback path that replaced failed LiteLLM key
    validation with an empty UserAPIKeyAuth() object, allowing requests to reach MCP tooling without a valid
    LiteLLM key. This issue is fixed in version 1.84.0. (CVE-2026-59822)

According to its self-reported version, the instance of LiteLLM running on the remote web server is prior to 1.84.0. It is, therefore, affected by multiple vulnerabilities :

- An Authentication Bypass through OAuth2 Passthrough Fallback (CVE-2026-59822).

- An Authentication Bypass via Host Header Injection (CVE-2026-49468).

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
364361	LiteLLM < 1.84.0 Improper Authentication Vulnerability (GHSA-7488-6r32-c95q)	Nessus	Artificial Intelligence	Local	high
457424	Echo: litellm: security update to 1.84.0	Tenable Cloud Security	Echo Local Security Checks	Local	high
457424	Echo: litellm: security update to 1.84.0	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
115466	LiteLLM < 1.84.0 Multiple Vulnerabilities	Web App Scanning	Artificial Intelligence	Version Based	critical
445187	SCA: security update for litellm (GHSA-7488-6r32-c95q)	Tenable Cloud Security	SCA Checks	Local	high
445187	SCA: security update for litellm (GHSA-7488-6r32-c95q)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2026-59822

high

Tenable Plugins

high

high

high

critical

high

high