LiteLLM CVE-2026-59822: CISA KEV AI Infra Attacks

The tooling that runs modern AI applications is now a first-class target for attackers, and the federal government has made it official. On September 2, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added seven vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. Three of the seven hit AI and ML infrastructure directly — the LLM gateway LiteLLM, the orchestration platform Kestra, and the widely embedded Python framework Starlette — the first time AI/ML components have made up nearly half a single KEV batch.

The headline entry for AI teams is CVE-2026-59822, an improper authentication flaw in BerriAI’s LiteLLM carrying a CVSS score of 8.8. LiteLLM is one of the most widely deployed proxies for routing requests across dozens of model providers, and the bug sits in exactly the component teams increasingly rely on to connect models to external tools.

What CVE-2026-59822 is

The vulnerability lives in LiteLLM’s Model Context Protocol (MCP) Streamable HTTP endpoint. According to the advisory, the MCP auth handler contained a fallback path that, when LiteLLM key validation failed, would replace the failed check with an empty UserAPIKeyAuth() object via an OAuth2 passthrough fallback. The practical effect: a request carrying a fabricated Authorization header — an arbitrary bearer token — could establish an authenticated MCP session without a valid LiteLLM key.

From there, an unauthenticated attacker could list and call configured MCP tools and reach any connected services exposed through them. That is a serious blast radius. MCP servers are wired into databases, file systems, internal APIs, and SaaS connectors, and they are frequently granted broad permissions so agents can act on a user’s behalf. A flaw that lets an outsider assume an authenticated session turns the gateway into an open door to everything behind it.

The issue is fixed in LiteLLM 1.84.0. CISA set a remediation deadline of September 16, 2026 for federal agencies to patch or stop using the affected versions. It is not the only recent LiteLLM problem, either — the project also patched an admin-API authentication weakness (CVE-2026-35029) in the same window, underscoring that the gateway’s control plane has become a focus for researchers and attackers alike.

The other AI-infrastructure entries

Two more of the seven listings target the plumbing around AI systems:

• CVE-2026-49869 — Kestra OSS OS Command Injection. Kestra is an open-source orchestration and workflow platform used to schedule data and ML pipelines. An OS command injection flaw lets an attacker run arbitrary commands on the host — a direct path to reverse shells and cryptocurrency miners. CISA gave Kestra one of the shortest fuses in the batch, a three-day remediation window with a September 5 deadline, a signal of how aggressively it is being exploited.
• CVE-2026-48710 — Kludex Starlette HTTP Request/Response Smuggling. Starlette is the ASGI framework underneath FastAPI, which in turn underpins a large share of Python AI and inference services. A request/response smuggling flaw can let an attacker desynchronize how a front-end proxy and back-end server parse requests, enabling cache poisoning, security-control bypass, or the injection of malicious requests. Like LiteLLM, it carries a September 16 deadline.

The remaining four entries are conventional enterprise targets: CVE-2026-9586 (Sangoma Switchvox SQL injection), CVE-2026-82329 (JFrog Artifactory improper authentication), and two SonicWall SMA1000 flaws — CVE-2026-83548 (server-side request forgery) and CVE-2026-83549 (OS command injection) — that were part of the SonicWall SMA1000 zero-day cluster. Those five carried the tighter September 5 deadline.

How the flaws are being used

CISA and outside researchers describe a familiar post-exploitation playbook applied to a new set of targets. Attackers are chaining these flaws to gain administrative access, execute commands, deploy reverse shells and cryptocurrency miners, and steal credentials. The AI-infrastructure entries add a distinct motive on top of commodity abuse: follow-on access. A compromised LLM gateway or orchestration server is not just a machine to mine crypto on — it is a pivot point into the models, data pipelines, and connected tools an organization has wired into it.

That is what makes the MCP angle in LiteLLM especially notable. MCP was designed to let AI agents reach external systems through a standardized interface, but the same design that makes agents useful makes a hijacked MCP session powerful. It follows a pattern seen in other recent MCP-related bugs, such as the Ruflo MCP bridge remote code execution flaw: the connective tissue between models and tools is emerging as a high-value target precisely because it is trusted and highly privileged.

Why the KEV listing matters

The KEV catalog is binding only on Federal Civilian Executive Branch agencies, which must remediate listed flaws by the assigned deadline under CISA’s directives. But the private sector treats KEV as the top of the patch queue for a reason: inclusion means CISA has evidence the flaw is being exploited in the wild right now, not merely that it is theoretically dangerous. Of the vast majority of CVEs that are never weaponized, KEV is the filter that separates real, active threats from the backlog — a distinction covered in our explainer on CVSS scoring and the limits of severity numbers alone.

Several of these entries fit the recurring pattern where a patched flaw is exploited well before it is catalogued, the same dynamic that drove the Oracle WebLogic KEV addition months after fixes shipped. For AI teams, the LiteLLM and Kestra entries carry an extra sting: these are relatively young open-source projects adopted rapidly during the AI build-out, often deployed by teams whose primary expertise is ML rather than security, and frequently exposed to networks in ways that mature enterprise software would not be.

What to do

For organizations running any of the affected components, the steps are straightforward but time-sensitive:

• Upgrade LiteLLM to 1.84.0 or later, patch Kestra and Starlette/FastAPI stacks to fixed releases, and apply the vendor fixes for the SonicWall, JFrog, and Switchvox entries.
• Restrict exposure of MCP and admin endpoints. LiteLLM’s MCP Streamable HTTP endpoint and its administrative routes should not be reachable from untrusted networks. Put them behind authentication that does not depend on the flawed fallback path, and segment them off the public internet.
• Inventory MCP tool permissions. Enumerate every service, database, and API a connected MCP tool can reach, and reduce those grants to the minimum an agent actually needs. A zero-day-class auth bypass is only as dangerous as the permissions on the other side of it.
• Hunt for prior compromise on any instance that was reachable and unpatched — anomalous MCP tool calls, unexpected outbound connections, new processes consistent with miners or shells, and unusual admin activity.

Because the LiteLLM flaw allows an unauthenticated session with full tool access, exposed and unpatched gateways should be treated as potentially breached, not merely vulnerable.

What it means

The real story here is not any single CVE — it is the composition of the batch. When three of seven federally mandated patches target AI infrastructure, it marks a threshold: the software teams stood up to run models, orchestrate pipelines, and connect agents to tools has become as much of an attack surface as the databases and VPN appliances that have dominated KEV for years. Attackers follow deployment, and AI tooling has been deployed everywhere, fast, often without the security hardening that older enterprise software accreted over decades.

Who is most exposed: the many organizations that adopted LiteLLM, Kestra, FastAPI-based services, and MCP integrations during the 2026 AI rush and left them reachable, over-permissioned, or unpatched. Who benefits from the shift: attackers who now have a fresh, under-defended class of high-value targets — gateways that sit astride an organization’s models, data, and connected systems.

The MCP dimension is the one to watch next. As agents are given more autonomy and more tool access, the gateways that broker that access concentrate risk in a way the industry is only beginning to reckon with. Expect MCP servers, LLM proxies, and orchestration platforms to keep appearing on future KEV lists — and expect the security expectations for AI infrastructure to rise sharply, from network isolation and least-privilege tool grants to the kind of routine patch discipline that the rest of enterprise software learned the hard way.