On September 2, 2026, the US Cybersecurity and Infrastructure Security Agency added CVE-2026-59822, an authentication bypass in BerriAI’s LiteLLM, to its Known Exploited Vulnerabilities catalog, confirming the flaw is being actively exploited in the wild. LiteLLM is a widely used proxy and gateway that lets applications and agent frameworks call different large language model APIs through one OpenAI-compatible interface, and its MCP Streamable HTTP endpoint is the piece that broke. Federal civilian agencies now carry a September 16, 2026 deadline to patch or mitigate under CISA’s binding operational directive process.
The bug lives in how LiteLLM’s Model Context Protocol handler validates incoming requests. A correctly formed LiteLLM API key should be required before a client can list or invoke MCP tools, but a crafted, fabricated Authorization header could trigger an OAuth2 passthrough fallback path that, instead of rejecting the bad credential, silently substituted an empty authentication object. That empty object was still treated as authenticated, so an outside caller with no valid key could reach every MCP tool and downstream service the proxy was configured to expose, with a GitHub Security Advisory (GHSA-7488-6r32-c95q) rating the flaw 8.8 out of 10 on the CVSS scale. The fix shipped in LiteLLM 1.84.0; anyone who cannot upgrade immediately is being told to disable MCP routes entirely or block access to the /mcp/ path at a reverse proxy.
What makes this one worth tracking rather than filing away as routine patch news is what LiteLLM sits in front of. As organizations wire agents to internal databases, ticketing systems, and code repositories through MCP servers, the proxy layer between the agent and those tools becomes a single point that, if it fails open, hands over everything behind it. An unauthenticated caller here was not just chatting with a model; it could call the same tools a legitimate agent would, against the same connected systems, without ever proving who it was.
The CISA listing matters because it converts a disclosed vulnerability into a confirmed, in-the-wild attack, which is a different and more urgent signal than a CVE score alone. For any team running LiteLLM’s MCP gateway in front of agent tooling, this is not a theoretical risk to schedule around; it is a known, live exploitation path with a federal remediation clock already running, and it is a preview of how MCP infrastructure - not the model itself - will keep being the softest part of the agent stack.