ACVE-2026-0401

In the wild

exploited-itw · 2026-09-02 – 2026-09-02 · kev, vendor

Description

What

CVE-2026-59822 is listed in the cited KEV material for LiteLLM proxies below 1.84.0 when an MCP Streamable HTTP endpoint is reachable. The impact is unauthenticated use of MCP tooling behind the gateway. This record keeps the ecosystem package and the exposed endpoint condition together.

Which configuration is exposed

The exposed configuration is litellm below 1.84.0 with a reachable MCP endpoint and no effective authentication boundary. A local package entry alone does not establish that the endpoint is enabled; an endpoint without the vulnerable package range is outside this record.

How ACVE detects it

ACVE checks the resolved PyPI package and version in an MCP server entry. It does not send a request to the endpoint or test bearer validation. Unknown package resolution or endpoint data is possible rather than safe.

Fix

Upgrade to 1.84.0 or later, rebuild the lock, and place authentication and network controls in front of MCP HTTP. Remove public exposure while upgrading and review tokens that may have been accepted by the gateway.

Grounding needed

Grounding should confirm the KEV date and affected package range. The KEV source supplies the required primary exploitation classification; exact victims remain undisclosed.

This record is limited to the condition named in the public source: LiteLLM MCP HTTP endpoint permits unauthenticated use. A match is a review signal for that condition, not a claim that every installation, package, model, or host was compromised. Operators should preserve the resolved evidence and investigate adjacent credentials, network exposure, and execution history before closing the finding. The result should be retained with the lock snapshot used for the match so later review can distinguish configuration drift from a changed public record.

Configuration

some mcpServers where
  and
    package eq "pkg:pypi/litellm"
    resolvedVersion semverRange "<1.84.0"

Fix

Upgrade LiteLLM to 1.84.0 or later and protect MCP endpoints.

• Upgrade pypi:litellm to 1.84.0. Use the fixed release.
• Reconfigure mcpServers.urlHost. Require an authenticated reachable boundary.

Validation

No validation entries recorded.

Grounding

No grounding checks recorded.

References

No references recorded.