Beveiligingsadvies

CVE-2026-59822

CVE-kwetsbaarheidsdetails - eXtreme Datacenter Security Operations

Gepubliceerd 2026-07-08 19:32:18

Laatst bijgewerkt 2026-09-03 03:56:05

Toegewezen door GitHub_M

CVSS-score 8.8

Status PUBLISHED

Beschrijving

LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.84.0, LiteLLM's MCP Streamable HTTP endpoint allowed an unauthenticated attacker to use a fabricated Authorization header to trigger an OAuth2 passthrough fallback path that replaced failed LiteLLM key validation with an empty UserAPIKeyAuth() object, allowing requests to reach MCP tooling without a valid LiteLLM key. This issue is fixed in version 1.84.0.

← Alle CVE's bekijken Bekijk op cve.org ↗