CVE-2026-59822: BerriAI LiteLLM Improper Authentication Vulnerability

What it is

BerriAI LiteLLM contains an improper authentication vulnerability in the MCP Streamable HTTP endpoint that could allow an unauthenticated attacker to establish an authenticated MCP session using an arbitrary Bearer token.

What to do

Schedule the vendor fix into this week’s change window, prioritising internet-facing and business-critical systems. Confirm the fix is applied everywhere, not just where it was easy.

Priority

This week: Schedule into this week’s change window.

Severity (CVSS)

8.8 high

CISA assessment (SSVC)

actively exploited; attackers can automate it at scale; partial control or data exposure

Exploit probability (EPSS, 30 days)

0.8%, higher than 56% of all CVEs

Added to CISA KEV

2 September 2026

CISA fix-by date

16 September 2026 (US federal agencies; a sensible deadline for everyone)

Ransomware use

Not known

Weakness

CWE-287, CWE-306

References

• NIST NVD entry
• CISA KEV entry
• github.com/BerriAI/litellm/commit/73869f0faf7d11ee21adcb5f91b8c33a340b6c2c
• github.com/BerriAI/litellm/pull/26463
• github.com/BerriAI/litellm/releases/tag/v1.84.0
• github.com/BerriAI/litellm/security/advisories/GHSA-7488-6r32-c95q
• www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-59822
• www.wiz.io/blog/ai-infrastructure-honeypot

Sources: CISA Known Exploited Vulnerabilities · FIRST Exploit Prediction Scoring System (EPSS) · NIST National Vulnerability Database · CISA Vulnrichment (SSVC), via the CVE Program. This product uses data from the NVD API but is not endorsed or certified by the NVD. Summaries are machine-written from CISA’s description; treat the vendor’s advisory as the authority for fixes.