Thursday, September 3, 2026 — The Exploit Bulletin

CISA KEV · due 2026-09-16Authentication BypasshighCVSS 8.8 CVE-2026-59822

Unauthenticated MCP session establishment via arbitrary Bearer token in LiteLLM Streamable HTTP endpoint (CVE-2026-59822)

CISA placed this flaw in KEV on 2026-09-02 following Wiz honeypot observations of attacks against LiteLLM, and any exposed LiteLLM proxy below 1.84.0 lets an unauthenticated caller open an authenticated MCP session with an arbitrary Bearer token.

LiteLLM versions before 1.84.0 fail to properly validate credentials on the MCP Streamable HTTP endpoint, so an attacker who presents any Bearer token can establish an authenticated MCP session. This gives unauthenticated access to the tools and data exposed through the proxy's MCP integration.

Affected: BerriAI litellm < 1.84.0

How to Test

Check the running LiteLLM version (`pip show litellm` or the container image tag); anything below 1.84.0 is affected. Confirm whether the MCP Streamable HTTP endpoint is enabled and reachable from untrusted networks. Review proxy access logs for MCP session requests carrying Bearer tokens that do not correspond to any issued key.

How to Patch

Upgrade LiteLLM to 1.84.0 or later (release https://github.com/BerriAI/litellm/releases/tag/v1.84.0, fix in PR 26463). If you cannot upgrade immediately, block external access to the MCP Streamable HTTP endpoint at the network or reverse-proxy layer, or disable the MCP integration, and rotate any credentials reachable through MCP tools.

Evidence: CISA KEV ↗, VulnCheck KEV ↗, CISA adds CVE-2026-59822 to the Known Exploited Vulnerabilities catalog (2026-09-02) ↗, CISA SSVC: active ↗, Wiz Threat Research honeypot telemetry showing sustained attacks on LiteLLM and other AI services (2026-08-27) ↗

Sources: VulnCheck KEV ↗, CISA KEV ↗, CISA Advisories ↗

Permalink: /bulletin/2026-09-03/unauthenticated-mcp-session-establishment-via-arbitrary-bearer-token-cve-2026-59822

CISA KEV · due 2026-09-16Authentication BypasshighCVSS 6.5 CVE-2026-48710

HTTP request smuggling via host-part path injection bypasses path-based authentication in Starlette (CVE-2026-48710)

CISA added this flaw to KEV on 2026-09-02 with a 2026-09-16 remediation deadline, and any Starlette or FastAPI service whose authentication decisions depend on the reconstructed URL path remains open to unauthenticated bypass until upgraded.

Starlette versions before 1.0.1 allow an attacker to inject path components into the host portion of a request so that they are prepended to the actual path when the URL is reconstructed. Where authentication or authorization logic keys off that reconstructed path, an unauthenticated attacker can reach protected routes; the issue can be chained with CVE-2026-42271.

Affected: Kludex starlette < 1.0.1; Red Hat AI Inference Server images prior to 3.3.5 (CUDA and ROCm)

How to Test

Run `pip show starlette` (or inspect your lockfile / container SBOM) in every Python service and FastAPI application; any version below 1.0.1 is vulnerable. Identify middleware or dependencies that make authentication decisions from the reconstructed request URL path. Review access logs for requests carrying path-like content in the Host header or unusual host/path combinations hitting authenticated routes.

How to Patch

Upgrade starlette to 1.0.1 or later and redeploy affected services; for Red Hat AI Inference Server, move to the 3.3.5 images published in RHSA-2026:30089 (CUDA) and RHSA-2026:30088 (ROCm). Until upgraded, enforce authentication at a reverse proxy or gateway that does not depend on the application's reconstructed URL, and reject requests with malformed Host headers at the edge.