SECURITY_THREAT_PULSE
LIVE
LAST UPDATED
FIRST SEEN
4 SOURCES ON THIS EVENT
▲ ACT NOWCVE-2026-59822 · CVSS 8.8

BerriAI LiteLLM: attackers can get in without a password

AFFECTSBerriAI LiteLLM

OFFICIAL NAME: BerriAI LiteLLM Improper Authentication Vulnerability

WHAT IT IS · AI TOOLSIt connects to AI models and often holds the keys to paid services and data.

DO THIS FIRSTUpdate it and change any API keys stored in it. Not sure if you use it? Send this page to your IT provider or security lead and ask.

TECHNICAL SUMMARY BerriAI LiteLLM contains an improper authentication vulnerability in the MCP Streamable HTTP endpoint that could allow an unauthenticated attacker to establish an authenticated MCP session using an arbitrary Bearer token.

WHY THIS VERDICT Attacks are confirmed. The vulnerability is 116 days old, so current versions are being attacked.

HIGHEST CONFIRMED RUNG
EXPLOITED
CISA KEV
LISTED
EXPLOIT CODE
PROOF OF CONCEPT
// EVIDENCE LADDER

How far has it climbed?

CONFIRMED
REPORTED
NO EVIDENCE

  1. 01 TALK

    ▨ REPORTED, NOT CONFIRMED
    NEWEST EVIDENCE · 1 SOURCE

    CVE-2026-59822 discussed publicly (CIRCL sighting).

  2. 02 EXPOSED

    □ NOT TRACKED YET
    NO SOURCE FOR THIS STEP YET

    We have no source that counts exposed systems yet. Internet scan data needs a partnership we do not have. No evidence here does not mean nothing is exposed.

  3. 03 TRIED

    ■ CONFIRMED
    NEWEST EVIDENCE · 2 INDEPENDENT SOURCES

    Attacks that worked are confirmed (step 4), so attempts count as confirmed too.

  4. 04 EXPLOITED

    ■ CONFIRMED
    NEWEST EVIDENCE · 2 INDEPENDENT SOURCES

    BerriAI LiteLLM contains an improper authentication vulnerability in the MCP Streamable HTTP endpoint that could allow an unauthenticated attacker to establish an authenticated MCP session using an arbitrary Bearer token. CISA Vulnrichment marks CVE-2026-59822 as actively exploited.

  5. 05 DAMAGE

    □ NOT TRACKED YET
    NO SOURCE FOR THIS STEP YET

    Breach notices and filings rarely name the flaw that was used, so we cannot link them to this event yet. No evidence here does not mean no harm.

// THE CLOCK

When each thing happened

  1. DISCLOSED
    CVE-2026-59822 published
  2. EXPLOIT CODE PUBLIC
    CIRCL Vulnerability-Lookup sightings
  3. FIRST ATTACK REPORT
    CISA Known Exploited Vulnerabilities
  4. CISA KEV LISTING
    CISA KEV listing
  5. US FEDERAL DEADLINE
    CISA deadline for US federal agencies
Attacks were reported 56 days after disclosure. CISA listed it 56 days after disclosure.

THE FIX

CISA's instruction: apply the vendor's fix, or stop using the product if no fix exists. The deadline CISA set for US federal agencies, Sep 16, 2026, has passed. It is a US government deadline; use it as a guide.

// ASK YOUR TEAM

Questions to ask this week

// TIMELINE · PACIFIC TIME

How it unfolded

  1. Attack activity. JUL 8, 2026
    CISA Vulnrichment marks CVE-2026-59822 as actively exploited
  2. Attack activity. SEP 1, 2026
    BerriAI LiteLLM Improper Authentication Vulnerability
  3. SEP 2, 2026
    1 public GitHub repository claims a proof of concept for CVE-2026-59822
  4. OCT 26, 2026
    CVE-2026-59822 discussed publicly (CIRCL sighting)
  5. OCT 26, 2026
    Public proof of concept for CVE-2026-59822 (CIRCL sighting)

SOURCES

  1. [1] CIRCL Vulnerability-Lookup sightings: CVE-2026-59822 discussed publicly (CIRCL sighting), OCT 26
  2. [2] PoC-in-GitHub: 1 public GitHub repository claims a proof of concept for CVE-2026-59822, SEP 2
  3. [3] CISA Known Exploited Vulnerabilities: BerriAI LiteLLM Improper Authentication Vulnerability, SEP 1
  4. [4] CVE List V5 and CISA Vulnrichment: CISA Vulnrichment marks CVE-2026-59822 as actively exploited, JUL 8