Which SIEM platforms have a CVE-2026-59822 detection rule?

df00tech provides CVE-2026-59822 (BerriAI LiteLLM Improper Authentication (CVE-2026-59822)) detection queries for 7 SIEM platforms: Microsoft Sentinel / Defender, Splunk, Elastic Security (EQL), IBM QRadar (AQL), Sumo Logic CSE, Google Chronicle / SecOps, CrowdStrike LogScale (CQL).

What data sources are required to detect BerriAI LiteLLM Improper Authentication (CVE-2026-59822) (CVE-2026-59822)?

Detecting BerriAI LiteLLM Improper Authentication (CVE-2026-59822) requires the following data sources: Network Proxy Logs, Web Application Firewall, Reverse Proxy Access Logs.

What severity and confidence is the CVE-2026-59822 detection?

The CVE-2026-59822 detection is rated high severity with medium confidence.

What are common false positives for CVE-2026-59822?

Common false positives for CVE-2026-59822 include: Internal health-check probes to /health or root that partially match path filters; Legitimate first-time key bootstrap performed by an operator from an admin jump host; Load balancer or uptime monitoring hitting completion endpoints without auth headers by design.

CVE-2026-59822 Google Chronicle · YARA-L

Detect BerriAI LiteLLM Improper Authentication (CVE-2026-59822) in Google Chronicle

Detects exploitation of CVE-2026-59822, a KEV-listed improper authentication / missing authentication vulnerability (CWE-287, CWE-306) in BerriAI LiteLLM. Affected deployments allow unauthenticated or improperly authenticated access to the LiteLLM proxy/admin API, enabling attackers to reach privileged endpoints (model management, key generation, config, and completion routing) without valid credentials. Detection focuses on anomalous access to LiteLLM proxy endpoints — successful requests to sensitive paths lacking Authorization/master-key headers, key-generation and admin actions from unexpected sources, and access patterns to /key/generate, /user/new, /model/new, /config/update and completion endpoints without prior authentication.

MITRE ATT&CK

Tactic: Initial Access Privilege Escalation Credential Access

YARA-L Detection Query

Google Chronicle (YARA-L)

yaral

rule litellm_improper_auth_cve_2026_59822 {
  meta:
    author = "Argus"
    description = "Detects unauthenticated access to LiteLLM admin/completion endpoints (CVE-2026-59822)"
    severity = "HIGH"
  events:
    $e.metadata.event_type = "NETWORK_HTTP"
    re.regex($e.network.http.parsed_user_agent, ".*") or true
    (
      $e.target.url = /.*\/key\/generate.*/ nocase or
      $e.target.url = /.*\/user\/new.*/ nocase or
      $e.target.url = /.*\/model\/new.*/ nocase or
      $e.target.url = /.*\/config\/update.*/ nocase or
      $e.target.url = /.*\/chat\/completions.*/ nocase
    )
    $e.network.http.response_code = 200
    not $e.additional.fields["authorization"] = /.+/
    $ip = $e.principal.ip
  match:
    $ip over 10m
  condition:
    $e
}

high severity medium confidence

Chronicle YARA-L rule flagging successful unauthenticated HTTP requests to LiteLLM sensitive endpoints, aligned with the missing authentication weakness in CVE-2026-59822.

Data Sources

Chronicle NETWORK_HTTPProxy Telemetry

Required Tables

udm.events

False Positives & Tuning

Load balancer health checks
Header enrichment gaps in UDM parser
Legitimate initial key provisioning

Other platforms for CVE-2026-59822

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

Test 1Unauthenticated key generation request against LiteLLM proxy
Expected signal: Proxy/access log entry for POST /key/generate on port 4000 with no Authorization header.
Test 2Unauthenticated model configuration change
Expected signal: Access log entry for POST /model/new without Authorization header.
Test 3Unauthenticated completion routing via exposed proxy
Expected signal: Proxy log entry for POST /chat/completions with no Authorization header from the test host.

Last updated: 2026-09-03 Research depth: standard

References (4)

Response Playbook

Triage

Confirm the target host is running BerriAI LiteLLM proxy and identify its version against GHSA-7488-6r32-c95q to determine if it is within the affected/unpatched range.
Review the flagged requests: determine whether the source IP is internal/trusted or external, and whether the sensitive endpoint (e.g. /key/generate, /model/new, /config/update) returned a 2xx status without an Authorization or master-key header.
Correlate the source IP's full request timeline to distinguish a single probe from a sustained exploitation sequence (enumeration followed by key generation and model routing changes).
Check LiteLLM proxy logs and any created virtual keys or users to establish whether unauthorized credentials were minted during the window.

Containment

Restrict network access to the LiteLLM proxy management/API ports (default 4000) to trusted management networks only, via firewall or security group rules.
Upgrade LiteLLM to the fixed version per GHSA-7488-6r32-c95q and ensure a strong LITELLM_MASTER_KEY / proxy auth is enforced on all admin endpoints.
Revoke and rotate any virtual keys, master keys, or user credentials that may have been generated or exposed during the exploitation window.

Evidence Collection

Preserve LiteLLM proxy access and application logs, and upstream reverse-proxy/WAF logs covering the suspicious source IP and time window.
Export the list of virtual keys, users, teams, and model configurations with their creation timestamps to identify attacker-created artifacts.
Capture the LiteLLM configuration (config.yaml/DB) and environment to document whether master-key enforcement was present at time of exploitation.

Escalation Criteria

!Escalate to incident response if unauthorized virtual keys, users, or model/config changes were created from an untrusted source.
!Escalate if the exploited proxy has access to backend LLM provider credentials or downstream systems, indicating potential lateral movement or credential theft.
!Escalate if exploitation originated from an external/internet-facing address, confirming exposure of an unpatched KEV-listed vulnerability.

Investigation Guide

Related Techniques

[object Object][object Object][object Object]

Forensic Artifacts

>LiteLLM proxy access logs showing requests to admin endpoints without Authorization headers
>LiteLLM database/config records of newly created virtual keys, users, and teams with anomalous timestamps
>Reverse proxy / WAF logs recording the source IP and request headers for the exploitation window

Tuning Guidance

Baseline the set of source IPs that legitimately administer the LiteLLM proxy (CI/CD runners, admin jump hosts) and exclude them from alerting. Confirm your log pipeline reliably captures request headers so the absence of Authorization is meaningful rather than a parsing gap — where headers are not logged, pivot to status-code and endpoint-based logic. Scope port filters to the actual LiteLLM listener ports in your environment and exclude health/readiness probe paths to reduce noise.

Hunting Queries

Hunts for unauthenticated access to LiteLLM administrative endpoints across proxy telemetry to surface exploitation attempts of CVE-2026-59822.

Hunting — KQL

kql

CommonSecurityLog | where RequestURL has_any ("/key/generate", "/model/new", "/config/update") | where AdditionalExtensions !has "Authorization" | summarize count() by SourceIP, RequestURL, bin(TimeGenerated, 1h)

Hunting — SPL

spl

index=proxy (uri="*/key/generate*" OR uri="*/model/new*" OR uri="*/config/update*") | eval has_auth=if(match(_raw,"(?i)authorization"),1,0) | where has_auth=0 | stats count by src_ip, uri

Atomic Red Team Tests

Test 1 Unauthenticated key generation request against LiteLLM proxy

linux

Simulates an attacker attempting to generate a virtual key on the LiteLLM proxy without providing a master key/Authorization header.

Command

bash

curl -s -o /dev/null -w '%{http_code}' -X POST http://localhost:4000/key/generate -H 'Content-Type: application/json' -d '{"models":["gpt-4"]}'

Cleanup

bash

curl -s -X POST http://localhost:4000/key/delete -H 'Content-Type: application/json' -d '{"keys":["sk-generated-test-key"]}' || true

Expected Telemetry

Proxy/access log entry for POST /key/generate on port 4000 with no Authorization header.

Expected Detection

Detection fires on unauthenticated request to /key/generate sensitive endpoint.

Test 2 Unauthenticated model configuration change

linux

Attempts to add a new model to the LiteLLM proxy configuration without authentication to test admin endpoint exposure.

Command

bash

curl -s -o /dev/null -w '%{http_code}' -X POST http://localhost:4000/model/new -H 'Content-Type: application/json' -d '{"model_name":"rogue","litellm_params":{"model":"gpt-4"}}'

Cleanup

bash

curl -s -X POST http://localhost:4000/model/delete -H 'Content-Type: application/json' -d '{"model_name":"rogue"}' || true

Expected Telemetry

Access log entry for POST /model/new without Authorization header.

Expected Detection

Detection fires on unauthenticated access to /model/new admin endpoint.

Test 3 Unauthenticated completion routing via exposed proxy

windows

Sends a chat completion request through the LiteLLM proxy without an API key to verify unauthenticated inference access.

Command

powershell

powershell -Command "try { Invoke-WebRequest -Uri 'http://localhost:4000/chat/completions' -Method POST -ContentType 'application/json' -Body '{\"model\":\"gpt-4\",\"messages\":[{\"role\":\"user\",\"content\":\"test\"}]}' -UseBasicParsing } catch { $_.Exception.Response.StatusCode.value__ }"

Cleanup

powershell

echo 'No cleanup required'

Expected Telemetry

Proxy log entry for POST /chat/completions with no Authorization header from the test host.

Expected Detection

Detection fires on unauthenticated completion request to the exposed proxy.

Related Detections

Tactic Hubs

TA0001Initial Access TA0004Privilege Escalation TA0006Credential Access

Related Techniques

T1190Exploit Public-Facing Application T1078Valid Accounts T1552.001Credentials In Files

Detect BerriAI LiteLLM Improper Authentication (CVE-2026-59822) in Google Chronicle

MITRE ATT&CK

YARA-L Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for CVE-2026-59822

Testing Methodology

Response Playbook

Triage

Containment

Evidence Collection

Escalation Criteria

Investigation Guide

Related Techniques

Forensic Artifacts

Tuning Guidance

Hunting Queries

Atomic Red Team Tests

Command

Cleanup

Expected Telemetry

Expected Detection

Command

Cleanup

Expected Telemetry

Expected Detection

Command

Cleanup

Expected Telemetry

Expected Detection

Related Detections

Tactic Hubs

Related Techniques

Same Tactic: Initial Access

Popular Detections

MITRE ATT&CK

YARA-L Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for CVE-2026-59822

Testing Methodology

Response Playbook

Triage

Containment

Evidence Collection

Escalation Criteria

Investigation Guide

Related Techniques

Forensic Artifacts

Tuning Guidance

Hunting Queries

Atomic Red Team Tests

Command

Cleanup

Expected Telemetry

Expected Detection

Command

Cleanup

Expected Telemetry

Expected Detection

Command

Cleanup

Expected Telemetry

Expected Detection

Related Detections

Tactic Hubs

Related Techniques

Same Tactic: Initial Access

Popular Detections

Get new detections in your inbox