CISA KEV: LiteLLM MCP Auth Bypass Lets Attackers Forge Sessions With Any Bearer Token (CVE-2026-59822)

CISA has added CVE-2026-59822, an improper authentication vulnerability in BerriAI's LiteLLM, to the Known Exploited Vulnerabilities (KEV) catalog as of 2026-09-02, indicating confirmed active exploitation in the wild.

What happened

According to the GitHub Security Advisory, the flaw resides in LiteLLM's MCP Streamable HTTP endpoint. Improper authentication handling allows an unauthenticated attacker to establish an authenticated MCP session by presenting an arbitrary Bearer token — the endpoint does not appear to properly validate the token before granting session access. No CVSS score has been published in the source data at this time.

Why it matters for defenders

LiteLLM is widely deployed as an LLM gateway/proxy sitting in front of production AI infrastructure, and the Model Context Protocol (MCP) endpoint is increasingly used to broker tool-calling and agentic workflows. An authentication bypass on this surface means an attacker could potentially obtain a valid session without credentials, gaining access to whatever tools, data sources, or backend capabilities the MCP session exposes — a significant risk given MCP servers are often wired into internal systems, credentials, or sensitive data stores. Any organization running LiteLLM with the MCP Streamable HTTP endpoint exposed, particularly to untrusted networks, should treat this as high priority.

What defenders should watch for now

• Inventory whether LiteLLM is deployed in your environment and whether the MCP Streamable HTTP endpoint is enabled and reachable.
• Review logs for MCP session establishment requests bearing unexpected, malformed, or previously-unseen Bearer tokens, especially from external or unexpected source IPs.
• Check for anomalous MCP tool invocations or data access patterns following session establishment that don't correlate with known service accounts or users.
• Restrict network exposure of the MCP endpoint to trusted callers only, and apply vendor guidance/patches as soon as they are available.
• Rotate any credentials or tokens that may have been reachable through MCP-brokered tools if compromise is suspected.

This is developing intelligence based on a fresh CISA KEV addition; specifics on exploitation techniques, affected versions, and remediation guidance should be confirmed directly from the source advisory as they are updated: GHSA-7488-6r32-c95q.