CISA Flags LiteLLM CVE-2026-59822: Attackers Forge Authenticated MCP Sessions With No Credentials

The U.S. Cybersecurity and Infrastructure Security Agency added a critical LiteLLM flaw to its Known Exploited Vulnerabilities catalog on 3 September 2026 — meaning it is being exploited in the wild right now. CVE-2026-59822 (CVSS 8.8) lets an unauthenticated attacker forge an authenticated Model Context Protocol session against the popular open-source AI gateway.

What happened

LiteLLM is one of the most widely deployed AI gateways — a single proxy that fronts 100+ model providers (OpenAI, Anthropic, Azure, Bedrock and more) behind one API. CVE-2026-59822 lets an attacker establish an authenticated Model Context Protocol (MCP) session without supplying valid credentials. Its addition to CISA's KEV catalog on September 3 is the signal that matters: CISA only lists vulnerabilities with confirmed active exploitation.

Why the gateway is the target

An AI gateway is, by design, the one place that holds every upstream provider key in an organisation. That concentration is the point of a gateway — and exactly why it is such a prize. Recent campaigns against LiteLLM and RAGFlow instances have followed a consistent playbook: get in, harvest model configuration and upstream provider key material, establish durable access, and deploy XMRig cryptocurrency miners to monetise the compute. When the front door to your models opens without a key, the blast radius is every model, every provider bill, and every dataset those models can reach.

What MCP has to do with it

The Model Context Protocol is the connective tissue of the agentic era — it is how AI agents discover and call tools. An authenticated MCP session is a privileged position: it can enumerate and invoke the tools a gateway exposes. Bypassing authentication to reach that session collapses the trust boundary the whole protocol depends on. It is a concrete example of the risk our MCP Guard and OWASP LLM guidance exist to surface: MCP endpoints are attack surface, and they need the same authentication rigour as any other API.

What to do now

• Update LiteLLM to the fixed release without delay, and confirm the version actually running in every environment — gateways proliferate quietly across teams.
• Rotate provider keys that a LiteLLM instance held if it was internet-reachable. Assume the keys were read.
• Lock down MCP endpoints. Require authentication, restrict network exposure, and inventory which tools each session can reach. Check yours against MCP Guard.
• Watch the bill. Cryptomining and free-inference abuse show up as spend before they show up in logs — anomalous provider or cloud cost is an early breach signal.
• Map the surface. Use the free AI Footprint Scanner to find exposed gateways and AI services before an attacker does.

Sources

• The Hacker News — CISA Adds Seven Exploited Flaws (Sep 3, 2026)
• CISA — Known Exploited Vulnerabilities Catalog