LiteLLM Proxy: forged Authorization header reaches MCP tooling without a valid API key

Impact

LiteLLM's MCP Streamable HTTP endpoint fell back to an OAuth2 passthrough path when LiteLLM key validation failed, substituting an empty UserAPIKeyAuth() object instead of rejecting the request. An unauthenticated caller who can reach the proxy port gets to invoke MCP tooling as an effectively keyless principal. On a GPU fleet the LiteLLM proxy is usually the shared front door for every tenant's model traffic and often holds upstream provider keys and MCP server credentials, so this collapses the boundary that separates tenants from each other and from the backends. CISA lists this in the Known Exploited Vulnerabilities catalog, so treat exposure as active rather than theoretical.

Who can reach it

Anyone who can open an HTTP connection to the LiteLLM proxy's MCP endpoint. No authentication and no valid LiteLLM key required - the attacker supplies a fabricated Authorization header. Exposure is limited to whoever can route to the proxy: cluster-internal only if the Service is not published, any tenant pod if it is.

What to do

Upgrade to LiteLLM 1.84.0 or later and restart the proxy; the fix is in commit 73869f0. This is a container image bump and a rolling restart of the proxy deployment - no GPU node drain or reboot is involved, though in-flight streaming requests will be cut. Until the upgrade lands, keep the MCP endpoint off any network a tenant or the internet can reach and rotate any upstream provider or MCP credentials the proxy holds, since exploitation leaves no key trail to audit.

References

Related entries

• NVIDIA OpenShell: a malicious gateway can inject OS commands into the connecting clientCVE-2026-65091 · NVIDIA OpenShell (gateway response handling)High
• Hugging Face peft: CorDA and LoRA-GA load cache files with unsafe torch.load, giving code executionCVE-2026-71281 · Hugging Face peft - LoRA-GA and CorDA initialization (torch.load without weights_only)High
• ChromaDB (Rust): Missing authorization validationCVE-2026-8828 · ChromaDB (Rust)High
• vLLM OpenAI-compatible server (qwen3_coder tool-call parser): Code execution inside the serving process, which on a GPUNCVD-2025-017-vllm-openai-compatible-server-qw · vLLM OpenAI-compatible server (qwen3_coder tool-call parser)High
• vLLM (multimodal prompt embeddings, sparse tensor validation): This is the advisory saying the earlier fix did notNCVD-2026-043-vllm-multimodal-prompt-embedding · vLLM (multimodal prompt embeddings, sparse tensor validation)High
• MLflow (statsmodels flavor, MLFLOW_ALLOW_PICKLE_DESERIALIZATION guard): SECURITY CONTROL BYPASS LEADING TO RCE: theNCVD-2026-054-mlflow-statsmodels-flavor-mlflow · MLflow (statsmodels flavor, MLFLOW_ALLOW_PICKLE_DESERIALIZATION guard)High