THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-59822 (HIGH 8.2) — LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.84.0, LiteLLM's MCP Streamable HTTP endpoint allowed an unauthenticated attacker to use a fabricated Authorization header to trigger an OAuth2 passthrough fallback path that replaced

[NVD] CVE-2026-59822 (HIGH 8.2) — LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.84.0, LiteLLM's MCP Streamable HTTP endpoint allowed an unauthenticated attacker to use a fabricated Authorization header to trigger an OAuth2 passthrough fallback path that replaced

lownvdPublished 2026-07-08

CVE-2026-59822 CVSS: 8.2 HIGH Published: 2026-07-08T20:16:57.683

LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.84.0, LiteLLM's MCP Streamable HTTP endpoint allowed an unauthenticated attacker to use a fabricated Authorization header to trigger an OAuth2 passthrough fallback path that replaced failed LiteLLM key validation with an empty UserAPIKey

Indicators of compromise

CVE-2026-59822cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-59822