CRITICAL
GHSASUPPLY-CHAINCVE-2026-59822LLM07 Insecure Plugin DesignAML.T0051
LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback
Auth bypass lets attackers reach MCP tools and connected services with a fake Bearer token.
2 CRIT · 9 HIGH · 1 MED · THREAT RED · 12 items · Generated in 303s
Auth bypass lets attackers reach MCP tools and connected services with a fake Bearer token.
Shared credential secrets can be exfiltrated to attacker-controlled URLs by member users through the AI Agents MCP connector.
A low-privilege user can run another user's MCP workflow with the owner's credentials and access connected integration data.
A crafted Skills ZIP can write files outside the target directory and may enable code execution on vulnerable LiteLLM servers.
Authenticated users can make the server reach internal hosts and expose responses, bypassing SSRF controls.
Attackers may run Python in the LiteLLM proxy and expose secrets, especially if the master key is missing.
Missing auth checks let a member run another user's workflow with that owner's credentials and access connected data.
Privileged users could make LiteLLM read local files through test_connection, exposing sensitive host data.
Hidden PR text can steer an AI reviewer to access other projects and leak data with the reviewer's own permissions.
An actively exploited RCE in Langflow can let attackers take over exposed systems, so patching is urgent.
AI-generated apps shipped many exploitable flaws, increasing risk of outages, broken access control, and exposed secrets.
Trusted AI tools can hide malware activity inside normal workflows, making detection and response harder.