Vulnerability

CVE-2026-59822

Authentication flaw in LiteLLM's MCP Gateway OAuth2 header handling, discovered by Wiz, where failed token validation returns an unrestricted auth object.

Known aliases

GHSA-7488-6r32-c95q

Current stories

securityConfirmed4 publishers

CISA's seven new KEV entries put SonicWall gateways and Artifactory on one patch clock

SonicWall's CVSS 10.0 SSRF chains into command execution on remote access appliances, and JFrog Artifactory hands unauthenticated attackers admin under default configuration. Reverse shells and miners are already landing.

Publishers:blog.rapid7.com cisa.gov scworld.com thehackernews.com

Perspective Coverage

4 publishers

Builder: Builder 14%
Operator: Operator 72%
Investor: Investor 14%

Reality

Evidence70
Adoption: Not scored
Hype gap+10
Incentives35
Confidence68

buildOne report1 publisher

MCP Atlassian hands unidentified HTTP callers the operator's Jira and Confluence access

MCP Atlassian releases before 0.22.0 fall back to the operator's credentials whenever an HTTP caller has no verified identity (CVE-2026-77244). HTTP deployments need the upgrade, and the endpoint should be reachable only through a management network or an authenticating proxy.

Publishers:dev.to

Reality

Evidence40
Adoption: Not scored
Hype gap+10
Incentives: Not scored
Confidence40

buildOne report1 publisher

MCP's Python SDK fix needs a hard-coded OAuth issuer to protect machine-to-machine clients

MCP Python SDK maintainers rated a flaw that let a connected server choose where OAuth secrets were sent High, at 7.5. For its two machine-to-machine providers, upgrading changes nothing until the client names the issuer it expects.

Publishers:dev.to

Reality

Evidence50
Adoption: Not scored
Hype gap+15
Incentives30
Confidence50

buildOne report1 publisher

A low-privilege LiteLLM key could run system commands through its MCP test endpoints

LiteLLM's MCP test endpoints let any valid proxy key run arbitrary commands on the gateway, rated CVSS 8.8. CISA added the flaw to its Known Exploited Vulnerabilities catalog on June 8, 2026, confirming exploitation in the wild.

Publishers:dev.to

Reality

Evidence50
Adoption: Not scored
Hype gap+10
Incentives: Not scored
Confidence50

securityConfirmed2 publishers

Whoever holds a LiteLLM master key reads every provider key and the host's IAM credentials

Wiz found 294 of 3,074 internet-facing LiteLLM gateways answering admin requests in February, and two thirds of those had no key set at all rather than the documented sk-1234. That changes what needs fixing.

Publishers:thehackernews.com wiz.io

Reality

Evidence62
Adoption58
Hype gap+25
Incentives55
Confidence64

buildOne report1 publisher

ZoomEye's fingerprint for Cisco's exploited FMC bypass returned zero hosts

A single September 2026 KEV batch produced 1,262,273 GitLab matches and nothing at all for Cisco Secure Firewall Management Center, because the console holding one of the two 10.0 bugs is the one passive scanning cannot fingerprint.

Publishers:dev.to

Reality

Evidence45
Adoption55
Hype gap+10
Incentives70
Confidence50

buildOne report1 publisher

LiteLLM's MCP endpoint answered a failed key check with an empty auth object

CVE-2026-59822 is fixed in LiteLLM 1.84.0 and has been on CISA's exploited list since September 2. A ZoomEye scan two weeks later fingerprinted 33,005 internet-reachable LiteLLM assets, a count of how widely the proxy is deployed.

Publishers:dev.to

Reality

Evidence55
Adoption62
Hype gap+10
Incentives55
Confidence55

securityOne report1 publisher

Attackers hid a cryptominer inside a LiteLLM MCP config test that reported success

Ninety days of Wiz honeypot telemetry shows tooling written for LiteLLM's internals, including a config test endpoint that spawns whatever command it is handed and a miner whose output comes home inside the MCP protocol.

Publishers:wiz.io

Reality

Evidence62
Adoption66
Hype gap+12
Incentives72
Confidence55