CISA added CVE-2026-59822 to the Known Exploited Vulnerabilities catalog on 2026-09-02, confirming active exploitation of an authentication bypass in BerriAI's LiteLLM AI gateway that lets an unauthenticated attacker reach MCP tooling with a fabricated Authorization header.
What Is It
LiteLLM is a proxy server (AI Gateway) used to call LLM APIs in OpenAI or native format. Prior to version 1.84.0, its MCP Streamable HTTP endpoint mishandled failed key validation: a fabricated Authorization header triggered an OAuth2 passthrough fallback path that substituted an empty UserAPIKeyAuth() object in place of the failed LiteLLM key check. The result is that requests reach MCP tooling without a valid LiteLLM key. CISA tracks it as "BerriAI LiteLLM Improper Authentication Vulnerability," mapped to CWE-287 (Improper Authentication) and CWE-306 (Missing Authentication for Critical Function).
Why It Matters
NVD scores this HIGH at CVSS 3.1 base 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N); the GitHub advisory's CVSS 4.0 score is 8.8. The attack is network-reachable, low-complexity, and requires no privileges and no user interaction, with high confidentiality impact. CISA's SSVC assessment marks exploitation as active and the vulnerability as automatable, with partial technical impact, meaning an attacker can script mass discovery and exploitation against exposed gateways. Its presence in the KEV catalog confirms exploitation is happening in the wild, not theoretical. Known ransomware campaign use is listed as Unknown, and CISA's required action for this entry includes compliance with its Forensics Triage Requirements, so affected organizations should plan for triage of exposed instances alongside patching.
What's Vulnerable
All LiteLLM versions prior to 1.84.0 (cpe:2.3:a:litellm:litellm, versionEndExcluding 1.84.0). The exposure is specifically the MCP Streamable HTTP endpoint.
Patch Status
Fixed in LiteLLM 1.84.0. CISA's required action is to apply mitigations per vendor instructions in compliance with BOD 26-04 (Prioritizing Security Updates Based on Risk) and CISA's Forensics Triage Requirements, follow applicable BOD 26-04 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Stakeholders must evaluate each asset's internet exposure. Due date: 2026-09-16.
Sources
- CISA KEV Catalog; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-59822
- NVD, CVE-2026-59822, https://nvd.nist.gov/vuln/detail/CVE-2026-59822
- GitHub Security Advisory GHSA-7488-6r32-c95q; https://github.com/BerriAI/litellm/security/advisories/GHSA-7488-6r32-c95q
- LiteLLM v1.84.0 Release Notes; https://github.com/BerriAI/litellm/releases/tag/v1.84.0
- Patch commit 73869f0; https://github.com/BerriAI/litellm/commit/73869f0faf7d11ee21adcb5f91b8c33a340b6c2c
- Pull Request #26463; https://github.com/BerriAI/litellm/pull/26463
- Wiz, AI Infrastructure Honeypot, https://www.wiz.io/blog/ai-infrastructure-honeypot
- CISA BOD 26-04; https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk