# CISA Flags LiteLLM CVE-2026-59822: Attackers Forge Authenticated MCP Sessions With No Credentials

> CISA added LiteLLM CVE-2026-59822 (CVSS 8.8) to its Known Exploited Vulnerabilities catalog on Sep 3, 2026 — an unauthenticated attacker can establish an authenticated MCP session against the popular AI gateway. Why the gateway is the prize, and how to respond.

Source: https://playciso.com/blog/litellm-cve-2026-59822-cisa-kev-mcp-session · Published: 2026-09-03 · Publisher: PlayCISO (https://playciso.com)

Primary source: https://thehackernews.com/2026/09/cisa-adds-seven-exploited-flaws-as.html

---

The U.S. Cybersecurity and Infrastructure Security Agency added a critical **LiteLLM** flaw to its Known Exploited Vulnerabilities catalog on **3 September 2026** — meaning it is being exploited in the wild right now. **CVE-2026-59822** (CVSS 8.8) lets an unauthenticated attacker forge an _authenticated_ Model Context Protocol session against the popular open-source AI gateway. 🔓 NO CREDENTIALS → AUTHENTICATED MCP SESSION ## What happened LiteLLM is one of the most widely deployed **AI gateways** — a single proxy that fronts 100+ model providers (OpenAI, Anthropic, Azure, Bedrock and more) behind one API. CVE-2026-59822 lets an attacker establish an authenticated [Model Context Protocol (MCP)](/tools/mcpguard) session **without supplying valid credentials**. Its addition to [CISA's KEV catalog on September 3](https://thehackernews.com/2026/09/cisa-adds-seven-exploited-flaws-as.html) is the signal that matters: CISA only lists vulnerabilities with confirmed active exploitation. ## Why the gateway is the target An AI gateway is, by design, the one place that holds **every upstream provider key** in an organisation. That concentration is the point of a gateway — and exactly why it is such a prize. Recent campaigns against LiteLLM and RAGFlow instances have followed a consistent playbook: get in, harvest **model configuration and upstream provider key material**, establish durable access, and deploy XMRig cryptocurrency miners to monetise the compute. When the front door to your models opens without a key, the blast radius is every model, every provider bill, and every dataset those models can reach. ## What MCP has to do with it The Model Context Protocol is the connective tissue of the agentic era — it is how AI agents discover and call tools. An authenticated MCP session is a privileged position: it can enumerate and invoke the tools a gateway exposes. Bypassing authentication to reach that session collapses the trust boundary the whole protocol depends on. It is a concrete example of the risk our [MCP Guard](/tools/mcpguard) and [OWASP LLM](/tools/llm-security) guidance exist to surface: MCP endpoints are attack surface, and they need the same authentication rigour as any other API. ## What to do now - Update LiteLLM to the fixed release without delay, and confirm the version actually running in every environment — gateways proliferate quietly across teams. - Rotate provider keys that a LiteLLM instance held if it was internet-reachable. Assume the keys were read. - Lock down MCP endpoints. Require authentication, restrict network exposure, and inventory which tools each session can reach. Check yours against MCP Guard. - Watch the bill. Cryptomining and free-inference abuse show up as spend before they show up in logs — anomalous provider or cloud cost is an early breach signal. - Map the surface. Use the free AI Footprint Scanner to find exposed gateways and AI services before an attacker does. ## Sources - The Hacker News — CISA Adds Seven Exploited Flaws (Sep 3, 2026) - CISA — Known Exploited Vulnerabilities Catalog **Securing an AI gateway or MCP server?** Run [MCP Guard](/tools/mcpguard) on your endpoints, work the [OWASP LLM Top 10](/tools/llm-security), and map your exposure with the free [AI Footprint Scanner](/tools/ai-footprint). No signup.