LiteLLM漏洞評測：MCP認證繞過遭駭客實戰利用 | LiteLLM MCP Bypass Review: CVE-2026-59822 Under Attack

9月 06, 2026

By Kit 小克 | AI Tool Observer | 2026-09-06

🇹🇼 LiteLLM漏洞評測：MCP認證繞過遭駭客實戰利用

LiteLLM 是目前最多團隊拿來做多供應商 LLM Gateway（統一轉接 OpenAI、Anthropic、Gemini 等 API 的閘道器）的開源專案，也是許多 AI Agent 串接 MCP（Model Context Protocol）工具的入口。2026 年 9 月 2 日，美國 CISA 把 CVE-2026-59822 列進「已知遭利用漏洞」（KEV）清單——這是一個藏在 LiteLLM 的 MCP Streamable HTTP 端點裡、CVSS 高達 8.8 分的認證繞過漏洞，而且已經有真實攻擊流量在網路上掃描利用。

漏洞怎麼運作：一個假造的 Bearer token 就夠了

問題出在 LiteLLM 處理 MCP 連線的認證邏輯。當攻擊者送出一個「格式正確但無效」的 Authorization 標頭時，程式碼原本設計的 OAuth2 「備援路徑」（fallback）會把驗證失敗的請求，錯誤地替換成一個空的 UserAPIKeyAuth() 物件——結果就是不需要任何有效金鑰，攻擊者照樣能建立一個「已認證」的 MCP session，直接摸到後端串接的工具與資料。

受影響版本：LiteLLM 1.84.0 之前的所有版本
修補版本：1.84.0 以上
攻擊門檻：不需登入、不需有效金鑰，遠端可觸發
已觀測行為：蜜罐（honeypot）記錄到攻擊者掃描 model enumeration 端點，嘗試列舉後端可用模型與工具

為什麼這比一般 CVE 更值得注意

這次 CISA 一口氣公告的七個 KEV 漏洞裡，有三個直接打在 AI 基礎設施上：除了 LiteLLM 的這個 MCP 認證繞過，還有 RAGFlow 的多個漏洞被用來偷 LLM 供應商金鑰，以及 Kestra 遭利用來部署加密貨幣挖礦程式與反向 shell。這說明攻擊者的目標已經從「傳統伺服器」轉向「AI 工作流背後那層轉接器」——因為 LLM Gateway 手上握著所有 API 金鑰與工具存取權，一旦被繞過認證，等於直接打開金庫。

該怎麼辦

如果你的團隊有自架 LiteLLM 當作內部 AI Gateway 或 MCP 伺服器：

立刻升級到 1.84.0 以上版本
檢查 MCP 端點是否曝露在公開網路，能收緊就收緊到內網或加防火牆白名單
盤點目前透過 MCP 串接的工具權限範圍，最小權限原則重新檢視一次
回頭查存取日誌，找有沒有來自陌生 IP、帶著偽造 Authorization 標頭的異常請求

美國聯邦機關依 CISA 規定必須在 9 月 16 日前完成修補，一般企業也建議比照這個時程處理，MCP 生態才剛起步，安全債欠得越早越難還。

好不好用，試了才知道。

🇺🇸 LiteLLM MCP Bypass Review: CVE-2026-59822 Under Attack

LiteLLM, the open-source project most teams use as their multi-provider LLM Gateway (a single entry point routing to OpenAI, Anthropic, Gemini, and more), and a common front door for AI agents connecting to MCP (Model Context Protocol) tools, just landed on CISA's radar. On September 2, 2026, CISA added CVE-2026-59822 to its Known Exploited Vulnerabilities (KEV) catalog — an authentication bypass in LiteLLM's MCP Streamable HTTP endpoint, CVSS 8.8, with confirmed exploitation already happening in the wild.

How the Bypass Works: One Fake Bearer Token Is Enough

The flaw lives in how LiteLLM handles MCP session authentication. When an attacker sends a well-formed but invalid Authorization header, the code's OAuth2 "passthrough fallback" path incorrectly swaps the failed key check for an empty UserAPIKeyAuth() object — meaning no valid credential is needed at all. The attacker walks away with a fully "authenticated" MCP session, reaching whatever tools and data sit behind it.

Affected versions: all LiteLLM releases prior to 1.84.0
Fixed in: 1.84.0 and later
Attack requirements: none, no login, no valid key, remotely triggerable
Observed activity: honeypots have logged attackers probing model-enumeration endpoints to map available backend models and tools

Why This One Deserves Extra Attention

Of the seven KEV entries CISA added in the same batch, three target AI infrastructure directly: this LiteLLM MCP bypass, multiple RAGFlow flaws used to steal LLM provider keys, and a Kestra vulnerability abused to drop cryptocurrency miners and reverse shells. The pattern is clear: attackers have moved past generic servers toward the gateway layer sitting between apps and LLM providers, because that layer holds every API key and every tool permission an AI agent has. Bypass its auth check once, and you have opened the vault.

What To Do

If your team self-hosts LiteLLM as an internal AI gateway or MCP server:

Upgrade to 1.84.0 or later immediately
Check whether MCP endpoints are exposed to the public internet; restrict to internal networks or firewall allowlists where possible
Audit which tools are reachable through your MCP setup and re-apply least-privilege scoping
Review access logs for anomalous requests carrying forged Authorization headers from unfamiliar IPs

Under CISA's BOD 26-04, U.S. federal agencies must remediate by September 16. Every other org running LiteLLM should treat that as their deadline too; the MCP ecosystem is still young, and security debt compounds fast.

好不好用，試了才知道。

Sources / 資料來源

延伸閱讀 / Related Articles

AI 工具觀察站 — 每日精選 AI Agent 與工具趨勢
AI Tool Observer — Daily curated AI Agent & tool trends

搜尋此網誌

AI小貼士