CVE-2026-59822 · High · CISA KEV

BerriAI LiteLLM Improper Authentication in MCP Streamable HTTP Endpoint

Threat Engine Auto-Feed · data current as of 2026-09-03

CVE-2026-59822, affecting BerriAI LiteLLM, is an improper authentication vulnerability in the MCP Streamable HTTP endpoint. It allows an unauthenticated attacker to establish an authenticated MCP session using any Bearer token. This vulnerability is actively exploited in the wild, as confirmed by its inclusion in the CISA KEV.

  • CVSS:
  • EPSS percentile: 0.56386
  • Exploitation pressure: 59/100 (High)

Exploitation reality: listed in CISA KEV (exploited in the wild) · EPSS 56th percentile. Threat × Vulnerability from public signals — impact depends on your environment.

Weakness —

This vulnerability stems from a flaw in how the system verifies user identity (authentication). Specifically, it fails to properly validate authentication tokens, allowing an attacker to bypass security checks by presenting an arbitrary token, effectively gaining unauthorized access.

Who's at risk

Exposure: unknown · Auth: unknown · unknown

Enterprise profiles most at risk

  • Organizations using BerriAI LiteLLM in their infrastructure
  • Financial services organizations (due to assessed targeting by FIN7, LockBit affiliates, APT38)
  • Technology companies (due to assessed targeting by APT29, Scattered Spider)

Misconfigurations that escalate it

  • Deployment of LiteLLM without robust perimeter security or network segmentation
  • Lack of continuous monitoring for unusual authentication attempts or session creations

High-impact scenarios

  • Unauthorized access to sensitive data or functionality within the LiteLLM environment
  • Establishment of persistent authenticated sessions by attackers, leading to further compromise
  • Potential for data exfiltration or system manipulation if the authenticated session grants sufficient privileges

Likely adversaries

  • FIN7 — Financial services (Assessed)
  • LockBit affiliates — Financial services (Assessed)
  • APT38 (Lazarus) — Financial services (Assessed)
  • APT29 (Cozy Bear) — Technology (Assessed)
  • Scattered Spider — Technology (Assessed)

What to do (defensive)

Detect

  • Monitor LiteLLM logs for unusual or unauthenticated access attempts to the MCP Streamable HTTP endpoint.
  • Look for the creation of authenticated MCP sessions originating from unexpected sources or using arbitrary Bearer tokens.
  • Implement network intrusion detection systems (NIDS) to flag suspicious traffic patterns targeting LiteLLM.

Contain

  • Isolate affected LiteLLM instances from critical network segments.
  • Review and revoke any potentially compromised sessions or tokens immediately.
  • Implement strict network access controls to limit exposure of the MCP Streamable HTTP endpoint.

Patch

  • Apply the latest security patches or updates for BerriAI LiteLLM as soon as they become available to address CVE-2026-59822.

Frontier verdict — High

High priority due to active exploitation in the wild (CISA KEV) and critical improper authentication flaw in BerriAI LiteLLM.

For detection-engineering and awareness only · point-in-time · not security advice · sourced from NVD, FIRST EPSS, CISA KEV. Adversary mappings are assessments unless cited.