BerriAI LiteLLM Improper Authentication Vulnerability Added to CISA KEV
CISA KEV · 3 sources
What's on the official record
CISA added CVE-2026-59822 to the Known Exploited Vulnerabilities Catalog. The vulnerability is an improper authentication vulnerability in BerriAI LiteLLM's MCP Streamable HTTP endpoint that could allow an unauthenticated attacker to establish an authenticated MCP session using an arbitrary Bearer token. CISA's dateAdded is 2 September 2026, and the dueDate for federal civilian agencies is 16 September 2026. The catalogVersion is 2026.10.21. The record names the fixed version as 1.84.0, meaning versions before 1.84.0 are affected. The catalog does not record known ransomware use.
CISA's ADP reports SSVC exploitation=active, automatable=yes, impact=partial. FIRST's EPSS model estimates a 0.008 exploitation probability (percentile 57, as of 23 October 2026).
Assessment
For a platform or AI-stack owner, the record lets you check the deployed LiteLLM version against 1.84.0 and confirm whether the MCP Streamable HTTP endpoint is reachable in your environment. Where a deployment runs a version before 1.84.0 with that endpoint exposed, the record supports patching to 1.84.0 or later as a patch-now action. The record also lets you decide whether to keep serving or restrict the endpoint until the fix is applied.
For a deal team, the record lets you scope diligence on any target that runs LiteLLM as an LLM gateway. You can condition a transaction on confirming the target's deployed version and whether the MCP Streamable HTTP endpoint is exposed, and price the remediation of any affected deployment. The catalog's active-exploitation designation is a factor to weigh in diligence scope and deal conditions.
What would change this call
A change to the catalog entry's dueDate, fixed version, or ransomware field would change the remediation posture. A BerriAI advisory naming a different affected or fixed version would change the patch target. A revised EPSS estimate or SSVC decision would change the urgency weighting.
What to check next
| Check | Why it matters |
|---|---|
| Confirm deployed LiteLLM version against 1.84.0 | Determines whether the fix applies |
| Confirm whether the MCP Streamable HTTP endpoint is exposed | Determines exploitability in the environment |
| Watch the CISA catalog entry for changes to dueDate, fixed version, or ransomware field | Changes remediation posture |
| Watch BerriAI advisories naming different affected or fixed versions | Changes the patch target |
Confidence
Filed 23 October 2026 from the record dated 2 September 2026.
Sources
[1] BerriAI LiteLLM Improper Authentication Vulnerability — https://nvd.nist.gov/vuln/detail/CVE-2026-59822
[2] CVE record CVE-2026-59822 — https://www.cve.org/CVERecord?id=CVE-2026-59822
[3] CISA Known Exploited Vulnerabilities Catalog — https://www.cisa.gov/known-exploited-vulnerabilities-catalog