CISA adds LiteLLM MCP auth bypass and six flaws to KEV
TL;DR
- Three of seven September 2 KEV entries target AI infrastructure, the first batch where AI components constitute nearly half the additions.
- Starlette arrives only as a transitive dependency under FastAPI, placing it outside CMDBs; lockfile scanning is the only viable detection path.
- LiteLLM's OAuth2 passthrough fallback replaced failed key validation with an empty auth object, letting any crafted Bearer token reach configured MCP tooling.
On September 2, 2026, CISA added seven vulnerabilities to its Known Exploited Vulnerabilities catalog, and one of them sits inside an AI proxy a lot of teams run without much thought. The Hacker News reported that CVE-2026-59822, an improper-authentication flaw in Berri's LiteLLM Model Context Protocol Streamable HTTP endpoint, "allows unauthenticated attackers to establish authenticated sessions using arbitrary Bearer tokens." CVSS 8.8.
The rest of the batch is a mix of routine and severe. Two SonicWall SMA 1000 flaws, CVE-2026-83548 (CVSS 10.0, server-side request forgery) and CVE-2026-83549 (CVSS 7.8, post-authentication OS command injection), are under "active exploitation" per SonicWall. Sangoma Switchvox carries an unauthenticated SQL injection at CVSS 9.3. JFrog Artifactory's default configuration ships a CVSS 9.8 authentication bug that hands attackers admin privileges. Kestra OSS scores a full 10.0 for an OS command injection that lets attackers create and execute arbitrary workflows. Kludex Starlette carries a CVSS 6.5 request-smuggling flaw.
Attackers chained the Starlette bug (CVE-2026-48710) with CVE-2026-42271 to bypass auth on LiteLLM installs and drop XMRig cryptocurrency miners. From there they went after the model plumbing: the LiteLLM_ProxyModelTable and LiteLLM_VerificationToken to harvest "model configuration, upstream provider keys, endpoints, and proxy-issued virtual keys," and modified "~/.ssh/authorized_keys" for persistence.
Microsoft described the compromise as opening "shell execution through the workflow engine, container-environment exposure through Docker socket access, host resource hijacking through miner deployment, and follow-on collection through workflow task execution." Microsoft and Wiz confirmed that LiteLLM, Flowise, LangChain, Langflow, ChromaDB, Ollama, Marimo, and MCP servers have become "lucrative targets" for stealing API keys, accessing backend systems, maintaining persistence, running prompt injections, and mining crypto — a pattern that keeps recurring across our AI infrastructure coverage.
Federal agencies must patch five of the seven bugs by September 5, 2026. The Starlette and LiteLLM flaws carry a September 16 deadline.
What others are reporting
-
CISA Read →
First-party source; specifies BOD 26-04 mandate requiring agencies to verify compromise before patching, not just patch.
These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise.
-
eSecurity Planet Read →
Adds 90-day Microsoft and Wiz honeypot telemetry showing credential harvesting, reverse shells, and cryptomining; connects to concurrent Coder registry compromise.
AI gateways are becoming high-value attack surfaces.
-
Forkast Read →
Frames the batch within the agentic economy, noting AI auth and routing layer compromise directly threatens agent behavior and data integrity.
Three of seven new KEV entries target AI and ML infrastructure, the first batch where AI components constitute nearly half the additions.
-
P.K. Sharma Read →
Identifies the transitive-dependency blind spot: Starlette ships beneath FastAPI, never appears in CMDBs, and lockfile scanning is the only viable detection path.
The catalogue can tell you a thing is being exploited and give you no way at all to find out whether you have it.
-
AiCybr Read →
Details the OAuth2 passthrough fallback mechanism, connects CVE-2026-59822 to sibling CVE-2026-35029, and provides a six-step operator response checklist.
A crafted Bearer token could reach configured MCP tooling without a valid LiteLLM key because the OAuth2 passthrough fallback could replace failed key validation.
-
DEV Community Read →
Maps attack flows, observability signals, and MITRE ATT&CK techniques across all seven CVEs, framing AI gateways and VPN appliances as a shared exploitation pattern.
CISA has added seven vulnerabilities to KEV affecting LiteLLM, Starlette, Kestra, JFrog Artifactory, Sangoma Switchvox, and SonicWall SMA 1000.
Originally reported by thehackernews.com
Read the original article →Original headline: CISA Adds LiteLLM CVE-2026-59822 MCP Auth-Bypass to KEV Catalog Amid Active Exploitation