Dashboard / CVE-2026-59822

CVE-2026-59822

HIGH CISA KEV
ACT NOW Priority: 0.07 BB Relevance: 78/100
Published: 2026-07-08 Modified: 2026-10-25 First seen: 2026-10-29 Status: active

Attack Surface

Network Low Complexity No Auth No Interaction Conf. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: None
UI: None
S: X
AT: None
VC: High
VI: Low
VA: None

Description

BerriAI LiteLLM contains an improper authentication vulnerability in the MCP Streamable HTTP endpoint that could allow an unauthenticated attacker to establish an authenticated MCP session using an arbitrary Bearer token.

CISA Known Exploited Vulnerability

Vendor / Product BerriAI — LiteLLM
Date Added 2026-09-02
Remediation Due 2026-09-16
https://github.com/BerriAI/litellm/security/advisories/GHSA-7488-6r32-c95q ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-59822

Weakness Classification (2)

Affected Software (1)

VendorProductVersion
litellm litellm < 1.84.0

References & Advisories (6)

Bug Bounty Relevance

78 / 100
✓ Network accessible
✓ No authentication
✓ Low complexity
✓ No user interaction
✓ Known exploited (KEV)

CVSS Score

8.8 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — Exploitation Probability

0.84%
Raw Score 0.008360
Percentile 57.6%
Date 2026-10-28

Intelligence Sources

kev ref →
nvd ref →

External Links