LiteLLM MCP auth bypass (CVE-2026-59822) exploited in the wild; on CISA KEV since Sept 2, 2026

Timing note: This is not an October 2026 event. CISA added CVE-2026-59822 to KEV on September 2, 2026. (CISA KEV JSON) It's included as launch seed content for the "Exploited AI attack" format.

TL;DR: In LiteLLM versions before 1.84.0, any made-up Bearer token could open an authenticated session on the MCP endpoint and reach the MCP tools configured there. CISA lists the flaw as known exploited. Upgrade to 1.84.0, or block /mcp/ until you can. (GHSA, CISA KEV)

Exploitation evidence

• CISA KEV: "BerriAI LiteLLM Improper Authentication Vulnerability", added 2026-09-02, due date for federal agencies 2026-09-16, known ransomware campaign use: Unknown. (CISA KEV JSON)
• Wiz Research: Wiz says it observed this flaw being exploited in its honeypots, with requests using single-character Bearer tokens to probe model enumeration endpoints. (Wiz honeypot report, Aug 27, 2026) Its disclosure timeline records exploitation first observed in a Wiz honeypot on 2026-07-07. (Wiz, Sep 9, 2026)

How the attack works

• LiteLLM's MCP auth handler supports OAuth2 passthrough for upstream MCP servers. When LiteLLM key validation failed, the fallback path could swap in an empty UserAPIKeyAuth() object, so a request with a fabricated Authorization header reached MCP tooling without a valid key. (GHSA)
• An attacker could list and call the configured MCP tools and reach connected services exposed through MCP. (GHSA)
• Wiz showed that a single-character token (Authorization: Bearer a) was enough to set up a fully authenticated MCP session. (Wiz) Which MCP servers an attacker can reach depends on configuration; servers marked allow_all_keys are available to the empty credential. (Wiz)
• Wiz notes that this bypass gives access to MCP servers only. It does not allow exploitation of the separate post-auth RCE, CVE-2026-59821. (Wiz)

Affected & fixed

Indicators

Wiz doesn't publish IOCs specific to this CVE. Its honeypot report lists IOCs for the broader LiteLLM/MCP campaign, which involved a different flaw, CVE-2026-42271. (Wiz) See that report rather than treating those IOCs as indicators for 59822.

What to do

• Upgrade LiteLLM to 1.84.0 or later. (GHSA)
• If you can't upgrade yet, disable MCP routes or block /mcp/ and related MCP endpoints at your reverse proxy or API gateway. (GHSA)
• KEV required action: apply mitigations per vendor instructions under BOD 26-04 guidance, or stop using the product if no mitigations are available. (CISA KEV)
• Wiz also recommends a strong, unique master key (not sk-1234) and least-privilege IAM for the proxy. (Wiz)

Why it matters

MoonSec analysis: AI gateways concentrate model-provider keys and MCP tool access in one place. A single auth fallback bug turned that into an open door, and attackers found it in the wild before it reached KEV.

Timeline

• 2026-04-25: Fix released in v1.84.0 (Wiz)
• 2026-06-30: GHSA-7488-6r32-c95q published (GHSA)
• 2026-07-07: Exploitation first observed in a Wiz honeypot (Wiz)
• 2026-07-08: CVE published (Wiz)
• 2026-08-27: Wiz honeypot telemetry report (Wiz)
• 2026-09-02: Added to CISA KEV (CISA KEV)
• 2026-09-16: KEV due date (CISA KEV)

Sources

• Primary: CISA KEV catalog JSON (catalog page: https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
• Primary: GitHub Security Advisory GHSA-7488-6r32-c95q
• Primary (researcher): Wiz: Off Guard, Breaking LiteLLM; Wiz: Inside 90 days of attacks on AI infrastructure