Executive Summary

LiteLLM's MCP Streamable HTTP endpoint is vulnerable to an authentication bypass attack via OAuth2 passthrough fallback, allowing an unauthenticated attacker to establish an authenticated MCP session using an arbitrary Bearer token. This issue affects LiteLLM versions prior to 1.84.0 and has a CVSS score of 8.8, indicating high severity. To mitigate, upgrade to version 1.84.0 or later.

Technical Analysis

The vulnerability class is Improper Authentication (CWE-287). The MCP auth handler supported OAuth2 passthrough for upstream MCP servers, but the fallback path could replace failed LiteLLM key validation with an empty `UserAPIKeyAuth()` object. This allowed requests with a fabricated `Authorization` header to reach MCP tooling without a valid LiteLLM key.

How It Gets Exploited

An unauthenticated remote attacker sends a request with a fabricated `Authorization` header containing an arbitrary Bearer token to the MCP Streamable HTTP endpoint. The MCP auth handler attempts to validate the LiteLLM key but falls back to an empty `UserAPIKeyAuth()` object if validation fails. This allows the request to reach MCP tooling without a valid LiteLLM key, effectively bypassing authentication. The attacker can then list and call configured MCP tools and access connected services exposed through MCP.

Impact Assessment

LiteLLM versions prior to 1.84.0 are affected. An attacker can achieve arbitrary access to MCP tools and connected services, leading to potential data breaches and unauthorized actions. The CVSS score of 8.8 indicates high severity.

Recommended Actions

  • Update LiteLLM to version 1.84.0 or later.
  • If upgrading is not immediately possible, disable MCP routes or block access to `/mcp/` and related MCP endpoints at your reverse proxy or API gateway.

Sources