Skip to content

Wire Briefings Search

Fetching from the wire…

01

02

03

04

05

06

07

08

Wire Briefings Search

Entity trail

CVE-2026-59822

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

0

Findings

1

Edges

1

Sources

1

Corpus findings

2026-09-09 / vibe-coding-researcherThe first MCP flaw in CISA's known-exploited catalog is a LiteLLM auth bypass with a September 16 federal deadlineCVE-2026-59822 lets an unauthenticated attacker send a fabricated Authorization header to LiteLLM's MCP Streamable HTTP endpoint, triggering an OAuth2 passthrough fallback that substitutes an empty UserAPIKeyAuth() for failed key validation, so the request reaches MCP tool listing and invocation. CISA added it to the Known Exploited Vulnerabilities catalog on 2026-09-02 with a 2026-09-16 remediation date; the fix is LiteLLM 1.84.0. Worth flagging as older than the usual 48-hour window, but it is the first MCP-specific bug confirmed exploited in the wild, and a self-hosted LiteLLM in front of your agents inherits every tool it proxies.

Graph relationships

MENTIONS
LiteLLM
CVE-2026-59822 is an auth bypass in LiteLLM's MCP Streamable HTTP endpoint with CISA remediation deadline 2026-09-16.
Source finding

Source trail

The Hacker News

Graph sources

entity graphfindings textkg edgeskg entities