{
  "schema_version": "1.6.0",
  "id": "ACVE-2026-0401",
  "aliases": [
    "CVE-2026-59822"
  ],
  "modified": "2026-09-20T00:00:00Z",
  "summary": "LiteLLM MCP HTTP endpoint permits unauthenticated use",
  "details": "## What\n\nCVE-2026-59822 is listed in the cited KEV material for LiteLLM proxies below 1.84.0 when an MCP Streamable HTTP endpoint is reachable. The impact is unauthenticated use of MCP tooling behind the gateway. This record keeps the ecosystem package and the exposed endpoint condition together.\n\n## Which configuration is exposed\n\nThe exposed configuration is litellm below 1.84.0 with a reachable MCP endpoint and no effective authentication boundary. A local package entry alone does not establish that the endpoint is enabled; an endpoint without the vulnerable package range is outside this record.\n\n## How ACVE detects it\n\nACVE checks the resolved PyPI package and version in an MCP server entry. It does not send a request to the endpoint or test bearer validation. Unknown package resolution or endpoint data is possible rather than safe.\n\n## Fix\n\nUpgrade to 1.84.0 or later, rebuild the lock, and place authentication and network controls in front of MCP HTTP. Remove public exposure while upgrading and review tokens that may have been accepted by the gateway.\n\n## Grounding needed\n\nGrounding should confirm the KEV date and affected package range. The KEV source supplies the required primary exploitation classification; exact victims remain undisclosed.\n\nThis record is limited to the condition named in the public source: LiteLLM MCP HTTP endpoint permits unauthenticated use. A match is a review signal for that condition, not a claim that every installation, package, model, or host was compromised. Operators should preserve the resolved evidence and investigate adjacent credentials, network exposure, and execution history before closing the finding. The result should be retained with the lock snapshot used for the match so later review can distinguish configuration drift from a changed public record.",
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "litellm"
      },
      "ranges": [
        {
          "type": "SEMVER",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.84.0"
            }
          ]
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "CRITICAL",
    "acve": {
      "specVersion": 1,
      "status": "candidate",
      "kind": "code",
      "vulnClasses": [
        "exposed-surface",
        "auth-bypass"
      ],
      "cwe": [
        "CWE-306"
      ],
      "exploitation": {
        "status": "exploited-itw",
        "checkedAt": "2026-09-20T00:00:00Z",
        "sources": [
          {
            "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59822",
            "type": "kev"
          },
          {
            "url": "https://www.tenable.com/cve/CVE-2026-59822",
            "type": "vendor"
          }
        ],
        "kev": {
          "listed": true
        },
        "first_seen": "2026-09-02",
        "last_seen": "2026-09-02",
        "victims": {
          "range": "unverifiable",
          "sectors": [
            "technology"
          ],
          "evidence": "CISA KEV lists the CVE; the public material does not give a victim count."
        },
        "attribution": "unattributed"
      },
      "cveBoundary": "exposed-surface",
      "matcher": {
        "some": "mcpServers",
        "where": {
          "all": [
            {
              "field": "package",
              "op": "eq",
              "value": "pkg:pypi/litellm"
            },
            {
              "field": "resolvedVersion",
              "op": "semverRange",
              "value": "<1.84.0"
            }
          ]
        }
      },
      "fix": {
        "summary": "Upgrade LiteLLM to 1.84.0 or later and protect MCP endpoints.",
        "actions": [
          {
            "type": "upgrade",
            "target": "pypi:litellm",
            "to": "1.84.0",
            "why": "Use the fixed release."
          },
          {
            "type": "reconfigure",
            "target": "mcpServers.urlHost",
            "why": "Require an authenticated reachable boundary."
          }
        ]
      },
      "grounding": {
        "itw": {
          "checkedAt": "2026-09-20T16:26:19Z",
          "sources": [
            {
              "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59822",
              "status": 200,
              "contentType": "text/html",
              "sha256": "sha256:4ddc9cbd52735f91c4ab194f9818629d55e370949e59e9bf748d0f6da2737fdc",
              "type": "kev"
            },
            {
              "url": "https://www.tenable.com/cve/CVE-2026-59822",
              "status": 200,
              "contentType": "text/html; charset=utf-8",
              "sha256": "sha256:102302fae06f131835498133eec42dd0b17aa8a187697ef7e91499d8832b7efd",
              "type": "vendor"
            }
          ],
          "kev": {
            "listed": true
          }
        }
      }
    }
  }
}