CVE-2026-59822 KEVPublic exploit High · 8.2 EPSS 0.8%

BerriAI LiteLLM Improper Authentication Vulnerability

BerriAI · LiteLLM

Summary

BerriAI LiteLLM, an AI Gateway proxy for calling LLM APIs, has an improper authentication flaw in its MCP Streamable HTTP endpoint, where a failed LiteLLM key validation falls back to an empty authentication object instead of rejecting the request. An unauthenticated remote attacker who sends a fabricated Authorization header can reach MCP tooling without a valid LiteLLM key, with no user interaction or prior authentication required.

Official description · NVD

LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.84.0, LiteLLM's MCP Streamable HTTP endpoint allowed an unauthenticated attacker to use a fabricated Authorization header to trigger an OAuth2 passthrough fallback path that replaced failed LiteLLM key validation with an empty UserAPIKeyAuth() object, allowing requests to reach MCP tooling without a valid LiteLLM key. This issue is fixed in version 1.84.0.

Breakdown

65.3 / 100

Exploited: Yes, in CISA KEV
Reports: 0
Tactics: 4/15

How an attack unfolds

Based on mappings. Select a step to see the evidence.

How attackers get in
- Break in through an internet-facing appT1190 · Exploit Public-Facing ApplicationAI-written (claude-haiku-5-5)Medium confidence149 general detection rules
What they do
- Log in with real accountsT1078 · Valid AccountsAI-written (claude-haiku-5-5)Medium confidence56 general detection rules

First seen exploited the day it was disclosed. Public exploit code (PoC-in-GitHub) appeared 57 days after disclosure.

DisclosedFirst seen exploitedVulnCheck KEV evidence8 Jul 2026day 0
Added to CISA KEVEU database agrees2 Sep 2026+56 days
Public exploit codePoC-in-GitHub3 Sep 2026+57 days

CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.

6 fixes in litellm over 5 months. The latest fix listed for litellm is 1.104.0rc2.

Fixes in litellmPyPI package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

1.83.14CVE-2026-4710121 May 2026
1.84.0CVE-2026-1277321 Jun 2026
1.84.0CVE-2026-4946822 Jun 2026
1.84.0CVE-2026-598228 Jul 2026KEV
1.96.2CVE-2026-843772 Sep 2026
1.104.0rc2CVE-2026-11461222 Oct 2026Latest listed

techniques

2 , grouped by in kill-chain order, 2 cited passages 2

Initial AccessTA0001

Valid Accounts T1078 Medium also Persistence, Privilege Escalation, Stealth

AI mapping from the description · primary impact

bypasses key validation granting access

allowing requests to reach MCP tooling without a valid LiteLLM key

From the official description (NVD) Original ↗

Exploit Public-Facing Application T1190 Medium

AI mapping from the description · how it is exploited

unauthenticated remote exploitation of public-facing endpoint

allowed an unauthenticated attacker to use a fabricated Authorization header

From the official description (NVD) Original ↗

Detection

0 rules for this CVE · 205 general rules for its techniques

Rules for this CVE

0 that reference CVE-2026-59822 directly.

CVE-specific rules are not available in this build. Search SigmaHQ ↗

General rules for this CVE’s techniques

These detect the technique in general, not this specific vulnerability.

Exploit Public-Facing ApplicationT1190149 general rules

Arcadyan Router Exploitationscriticaltest
Citrix ADS Exploitation CVE-2020-8193 CVE-2020-8195criticaltest
Citrix Netscaler Attack CVE-2019-19781criticaltest
Confluence Exploitation CVE-2019-3398criticaltest
CVE-2010-5278 Exploitation Attemptcriticaltest
CVE-2020-0688 Exchange Exploitation via Web Logcriticaltest
CVE-2020-10148 SolarWinds Orion API Auth Bypasscriticaltest
CVE-2020-5902 F5 BIG-IP Exploitation Attemptcriticaltest

All 149 on SigmaHQ ↗

Valid AccountsT107856 general rules

Win Susp Computer Name Containing Samtheadmincriticaltest
Account Created And Deleted Within A Close Time Framehightest
Activity From Anonymous IP Addresshightest
Atypical Travelhightest
Azure AD Threat Intelligencehightest
Azure Subscription Permission Elevation Via AuditLogshightest
External Remote SMB Logon from Public IPhightest
Impossible Travelhightest

All 56 on SigmaHQ ↗

Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: litellm.

PyPIlitellmGHSA-7488-6r32-c95q PYSEC-2026-3479

Upgrade to 1.84.0 or later

Fixes this CVE and 6 other known vulnerabilities in this package (CVE-2024-6587, CVE-2026-35029, +4).

pippip install "litellm>=1.84.0"

The first fix for CVE-2026-59822.

Affected versions

If you run	Upgrade to
All versions before 1.84.0	1.84.0

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

Also mentioned in 34 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

Actively_Exploited_Kev | Oct 31, 202630 Oct 2026
Actively_Exploited_Kev | Oct 30, 202629 Oct 2026
Actively_Exploited_Kev | Oct 29, 202628 Oct 2026
Actively_Exploited_Kev | Oct 28, 202627 Oct 2026
Actively_Exploited_Kev | Oct 27, 202626 Oct 2026
Actively_Exploited_Kev | Oct 24, 202623 Oct 2026
28 more on OTX

References

6 links, grouped by NVD tag

Exploitation evidence

Exploited in the wild

Listed since 2 Sep 2026. Federal due date 16 Sep 2026. No recorded ransomware use.

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

ENISA

Marked exploited since 2 Sep 2026. EUVD-2026-42359

Public exploitAdvisories link exploit code.

, 30 Oct 2026

0.8%Top 42%

Chance of exploitation in the next 30 days. of scored CVEs (riskier than 57.7%).

3.1

8.2High · 8.2

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Priority factorsFormula

In a KEV cataloglisted in CISA KEV and VulnCheck KEV 35.0/35

Recent KEV listingadded 115 days ago 5.0/10

Known ransomware usenot known 0.0/10

EPSS percentilepercentile 0.5769 11.5/20

Threat reports0 reports 0.0/10

Public exploit code1 PoC-in-GitHub repo 5.0/5

Mentioned in OTX pulses34 pulses 3.0/3

CVSS base scorebase score 8.2 5.7/7

End-of-life productsupported or unknown 0.0

Total65.3

Record

Published: 8 Jul 2026
Modified: 25 Oct 2026
: CWE-287 Improper AuthenticationCWE-306 Missing Authentication for Critical Functionality
Elsewhere: NVD CVE.org KEV JSON

How an attack unfolds

1How attackers get in

2What they do

Exploitation timelineExploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.

Patch historyPatch historyEarlier and later CVEs in the same code, in date order. It shows when a fix was bypassed or incomplete and which version finally fixed it.

Fixes in litellmPyPI package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

ATT&CKMITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques

Initial AccessTA0001

Detection

Rules for this CVE

General rules for this CVE’s techniques

Am I affected? What do I upgrade to?

Affected versions

What security researchers reported

Also mentioned in 34 community threat pulses (AlienVault OTX)

References

Vendor Advisory 1

Patch 2

US Government Resource 1

Third Party Advisory 1

Release Notes 1

How attackers get in

What they do

techniques