CVE-2026-59822: BerriAI LiteLLM Improper Authentication Vulnerability
Vulnerability summary
CVE-2026-59822 is a high (CVSS 8.8) Improper Authentication vulnerability in BerriAI LiteLLM. It is known to be exploited: CISA lists it, first on 02-09-2026. EPSS estimates a 0.84% chance of exploitation in the next 30 days, higher than 57% of scored vulnerabilities.
Timeline
- 08-07-2026PublishedVulnerability first disclosed.
- 02-09-2026Added to CISA KEVBerriAI LiteLLM Improper Authentication Vulnerability
- 03-09-2026Last modifiedVulnerability information updated.
- 16-09-2026CISA remediation dueApply mitigations per vendor instructions.
Description
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.84.0, LiteLLM's MCP Streamable HTTP endpoint allowed an unauthenticated attacker to use a fabricated Authorization header to trigger an OAuth2 passthrough fallback path that replaced failed LiteLLM key validation with an empty UserAPIKeyAuth() object, allowing requests to reach MCP tooling without a valid LiteLLM key. This issue is fixed in version 1.84.0.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · PypiEcosystem advisory · calculated8.8HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
- NVDNIST8.8HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS trend
Probability
0.84%
Chance of exploitation in the next 30 days
Percentile
57%
Versus all other CVEs
30-day change
-0.03 pp
From 0.87% on 19-09-2026
Known exploited
Compare KEV catalogs
CISA KEVListed- Added
- 02-09-2026
- Federal due date
- 16-09-2026
CISA required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. github.com/BerriAI/litellm/security/advisories/GHSA-7488-6r32-c95q nvd.nist.gov/vuln/detail/CVE-2026-59822
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-287Improper AuthenticationWhen an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
- CWE-306Missing Authentication for Critical FunctionThe product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
Affected systems
3 vendors · 3 products
References
10 links- github.com/BerriAI/litellm/security/advisories/GHSA-7488-6r32-c95qX Refsource CONFIRMWEBMitigationPatchVendor Advisory
- www.wiz.io/blog/ai-infrastructure-honeypotThird Party Advisory
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-59822Government ResourceUS Government Resource
- github.com/BerriAI/litellmPACKAGE
- pypi.org/project/litellmPACKAGE