LiteLLM: any made-up token opens the MCP tools behind the gateway
Identifiers: CVE-2026-59822 · GHSA-7488-6r32-c95q · PYSEC-2026-3479 · CVSS 4.0 8.8 (scored by GitHub)
What it is
LiteLLM is a gateway in front of LLM providers and MCP tools. On its MCP endpoint, a request with an invented Bearer token was let through without a valid LiteLLM key, so an attacker could list and call every MCP tool you configured, and reach whatever those tools connect to (databases, GitHub, internal APIs). CISA lists it as exploited in the wild.
On CISA's Known Exploited Vulnerabilities list since September 2, 2026.
Who is affected
Versions inside these ranges are affected. The fixed versions are the ones to move to.
| Registry | Package | Affected | Move to |
|---|---|---|---|
| PyPI | litellm | < 1.84.0 | 1.84.0 |
How to check
Run one of these in your project's folder; the first two download the CLI and check its SHA-256 first:
d="$(mktemp -d)" && a="xsec-$(uname -m | sed s/arm64/aarch64/)-unknown-linux-musl.tar.gz" && curl -fsSL -o "$d/$a" "https://github.com/xtruct-col/xsec-action/releases/latest/download/$a" && curl -fsSL -o "$d/checksums.txt" "https://github.com/xtruct-col/xsec-action/releases/latest/download/checksums.txt" && (cd "$d" && grep " $a$" checksums.txt | sha256sum -c -) && tar -xzf "$d/$a" -C "$d" xsec && "$d/xsec" depsdocker run --rm -v "$PWD:/src" -w /src alpine:3.20 sh -c 'apk add -q curl && d="$(mktemp -d)" && a="xsec-$(uname -m | sed s/arm64/aarch64/)-unknown-linux-musl.tar.gz" && curl -fsSL -o "$d/$a" "https://github.com/xtruct-col/xsec-action/releases/latest/download/$a" && curl -fsSL -o "$d/checksums.txt" "https://github.com/xtruct-col/xsec-action/releases/latest/download/checksums.txt" && (cd "$d" && grep " $a$" checksums.txt | sha256sum -c -) && tar -xzf "$d/$a" -C "$d" xsec && "$d/xsec" deps'xsec depsOr look up litellm in your lockfile and compare the version with the ranges above.
How to fix it
Upgrade litellm to 1.84.0 or later. Review the MCP tool calls in your logs and rotate the credentials of the services those tools reach.
Sources
This list is curated by hand and kept short on purpose: it is not every known vulnerability, and a clean xsec deps does not mean no dependency has a flaw. Use your package manager's audit (npm audit, pip-audit, bundle audit) or Dependabot for the rest.