CISA adds LiteLLM MCP auth bypass and six flaws to KEV

On September 2, 2026, CISA added seven vulnerabilities to its Known Exploited Vulnerabilities catalog, and one of them sits inside an AI proxy a lot of teams run without much thought. The Hacker News reported that CVE-2026-59822, an improper-authentication flaw in Berri's LiteLLM Model Context Protocol Streamable HTTP endpoint, "allows unauthenticated attackers to establish authenticated sessions using arbitrary Bearer tokens." CVSS 8.8.

The rest of the batch is a mix of routine and severe. Two SonicWall SMA 1000 flaws, CVE-2026-83548 (CVSS 10.0, server-side request forgery) and CVE-2026-83549 (CVSS 7.8, post-authentication OS command injection), are under "active exploitation" per SonicWall. Sangoma Switchvox carries an unauthenticated SQL injection at CVSS 9.3. JFrog Artifactory's default configuration ships a CVSS 9.8 authentication bug that hands attackers admin privileges. Kestra OSS scores a full 10.0 for an OS command injection that lets attackers create and execute arbitrary workflows. Kludex Starlette carries a CVSS 6.5 request-smuggling flaw.

Attackers chained the Starlette bug (CVE-2026-48710) with CVE-2026-42271 to bypass auth on LiteLLM installs and drop XMRig cryptocurrency miners. From there they went after the model plumbing: the LiteLLM_ProxyModelTable and LiteLLM_VerificationToken to harvest "model configuration, upstream provider keys, endpoints, and proxy-issued virtual keys," and modified "~/.ssh/authorized_keys" for persistence.

Microsoft described the compromise as opening "shell execution through the workflow engine, container-environment exposure through Docker socket access, host resource hijacking through miner deployment, and follow-on collection through workflow task execution." Microsoft and Wiz confirmed that LiteLLM, Flowise, LangChain, Langflow, ChromaDB, Ollama, Marimo, and MCP servers have become "lucrative targets" for stealing API keys, accessing backend systems, maintaining persistence, running prompt injections, and mining crypto — a pattern that keeps recurring across our AI infrastructure coverage.

Federal agencies must patch five of the seven bugs by September 5, 2026. The Starlette and LiteLLM flaws carry a September 16 deadline.