HIGH CISA-KEV ACTIVELY EXPLOITED

CVE-2026-59822

BerriAI LiteLLM Improper Authentication Vulnerability

BerriAI LiteLLM contains an improper authentication vulnerability in the MCP Streamable HTTP endpoint that could allow an unauthenticated attacker to establish an authenticated MCP session using an arbitrary Bearer token.

Affected Products

BerriAI: LiteLLM

References

Published: 2026-09-02 · Source: CISA-KEV · Feed updated: 2026-09-02

This high severity vulnerability was published on 2026-09-02 via CISA-KEV. ⚠ This vulnerability is in the CISA Known Exploited Vulnerabilities (KEV) catalog — it is being actively exploited in the wild. Affected: BerriAI: LiteLLM.

Risk Timeline

CVE Disclosed2026-09-02 · 0 days ago

CISA KEV — Actively ExploitedU.S. federal agencies required to patch · confirmed threat-actor activity

Remediation Resources

CISA / KEV

www.cisa.gov/known-exploited-vulnerabilities-catalog

NVD / MITRE

nvd.nist.gov/vuln/detail/CVE-2026-59822

vulnfeed aggregates 10363 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.