{"vulnerability": "CVE-2026-59822", "sightings": [{"uuid": "3acd1104-2561-4d97-8df1-224d479bba62", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59822", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mq63fj6aid2g", "content": "CVE-2026-59822 - LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback\nCVE ID : CVE-2026-59822\n \n Published : July 8, 2026, 8:16 p.m. | 58\u00a0minutes ago\n \n Description : LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1...", "creation_timestamp": "2026-07-08T21:39:18.889161Z"}, {"uuid": "c4d9ee70-89db-4d93-b067-9856c71e6771", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-59822", "type": "seen", "source": "https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-59822", "content": "", "creation_timestamp": "2026-07-09T00:15:14.416515Z"}, {"uuid": "9b2fb243-f117-4359-b700-037357f6aafa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59822", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mqk5qc4l5s2f", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-59822 \u0432 LiteLLM: \u0443\u0433\u0440\u043e\u0437\u044b \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/97FC7B77-8936-4785-9E19-4BE50D758738", "creation_timestamp": "2026-07-13T16:53:04.512282Z"}, {"uuid": "dcfc8d06-4320-4adf-8fb4-3e054ca342a6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59822", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mqlf37gpl52g", "content": "\ud83d\udccc CVE-2026-59822 - LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.84.0, LiteLLM's MCP Streamable HTTP endpoint allowed ... https://www.cyberhub.blog/cves/CVE-2026-59822", "creation_timestamp": "2026-07-14T04:37:07.003172Z"}, {"uuid": "7f240849-64d8-4772-9fbc-1b5d76e4f4cb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59822", "type": "seen", "source": "https://bsky.app/profile/khesefxyz.bsky.social/post/3mqqrjafjkc2t", "content": "\u05d4\u05e1\u05db\u05e0\u05d4 \u05d4\u05d7\u05d3\u05e9\u05d4: CVE-2026-59822 \u05d1-LiteLLM - \u05de\u05d4 \u05d6\u05d4 \u05d0\u05d5\u05de\u05e8 \u05dc\u05da?\n\n\n\nhttps://khesef.xyz/posts/B9006641-8BD6-406F-B400-29F44EA8A950", "creation_timestamp": "2026-07-16T08:03:01.403720Z"}, {"uuid": "ac1b4bf0-07bb-4716-af5d-8c013b03588a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59822", "type": "seen", "source": "https://bsky.app/profile/cvesentinel.bsky.social/post/3mukhktpfyz2b", "content": "\ud83d\uded1 CVE-2026-59822\nBerriAI LiteLLM\nCVSS 8.8 / EPSS 1% / KEV: No\nTL;DR: LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior\u2026\nhttps://cvesentinel.com/report/CVE-2026-59822?utm_source=bluesky&utm_medium=social&utm_campaign=cvesentinel\n#infosec #CVE #vulnerability", "creation_timestamp": "2026-09-02T17:29:45.722599Z"}, {"uuid": "e44a51ff-7c46-456c-8f07-647af4adb013", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59822", "type": "seen", "source": "https://bsky.app/profile/csirts.com/post/3mukj5h2uw323", "content": "\ud83d\udea8 Added to CISA KEV \u2014 actively exploited:\nCVE-2026-59822: BerriAI LiteLLM Improper Authentication Vulnerability\n\nhttps://www.csirts.com/cve/CVE-2026-59822", "creation_timestamp": "2026-09-02T17:58:03.766357Z"}, {"uuid": "5a8643bb-1d0f-416f-b18e-cefc1a86cddb", "vulnerability_lookup_origin": "405284c2-e461-4670-8979-7fd2c9755a60", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59822", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/b2e0c044-08c5-41bb-baab-bb5cd2619d20", "content": "", "creation_timestamp": "2026-09-02T18:00:01.896252Z"}, {"uuid": "935bc23c-4e5c-4885-9f23-bf638710052a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59822", "type": "seen", "source": "https://bsky.app/profile/cvesentinel.bsky.social/post/3mukjswiki426", "content": "\ud83d\uded1 CVE-2026-59822\nBerriAI LiteLLM\nCVSS 8.8 / EPSS 1% / KEV \u2705\nTL;DR: LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior t\u2026\nhttps://cvesentinel.com/report/CVE-2026-59822?utm_source=bluesky&utm_medium=social&utm_campaign=cvesentinel\n#infosec #CVE #vulnerability", "creation_timestamp": "2026-09-02T18:10:04.677043Z"}, {"uuid": "7271ab1d-5e5c-45e4-8178-fab3f2207a12", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59822", "type": "seen", "source": "https://infosec.exchange/users/AAKL/statuses/117202988713449046", "content": "Looks like CISA's on a roll. Seven vulnerabilities have been added to the catalogue.\n- CVE-2026-83549: SonicWall SMA1000 Appliances OS Command Injection Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-83549\n- CVE-2026-83548: SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-83548\n- CVE-2026-9586: Sangoma Switchvox SQL Injection Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-9586\n- CVE-2026-82329: JFrog Artifactory Improper Authentication Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-82329\n- CVE-2026-49869: Kestra OSS OS Command Injection Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-49869\n- CVE-2026-48710: Kludex Starlette HTTP Request/Response Smuggling Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-48710\n- CVE-2026-59822: BerriAI LiteLLM Improper Authentication Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-59822 #CISA #infosec #vulnerability", "creation_timestamp": "2026-09-02T19:01:24.697392Z"}, {"uuid": "eb700761-8146-4c5c-ac39-f66ce025ef60", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59822", "type": "seen", "source": "https://bsky.app/profile/threatspotai.bsky.social/post/3mult7nlvhp2q", "content": "\ud83d\udea8 CISA KEV Alert\nCVE-2026-59822: \u26a0\ufe0f CVE-2026-59822: New Actively Exploited Vulnerability Added to CISA KEV\nSeverity: HIGH | CVSS: 0.0 | EPSS: 0.5%\nActively exploited\n\nRead the full alert: https://threatspot.ai/alerts/2026-59822-litellm-is-a-proxy-server-ai", "creation_timestamp": "2026-09-03T06:30:55.329886Z"}, {"uuid": "7a4b3322-7cfc-4c7d-8027-7d086affe9da", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59822", "type": "seen", "source": "https://bsky.app/profile/thecybermind.co/post/3mulxswen632c", "content": "Mitigate CVE-2026-59822 in BerriAI LiteLLM. Unauthenticated attackers bypass token checks on MCP endpoints. Read our T-Suite brief for Splunk, Sentinel, and Chronicle detection rules, plus vital hardening controls to lock down your AI infrastructure today. https://thecybermind.co/5vrg", "creation_timestamp": "2026-09-03T07:53:17.883352Z"}, {"uuid": "a9623afe-3417-4b6a-951c-4f85835a3696", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59822", "type": "seen", "source": "https://bsky.app/profile/forsmile.jp/post/3mumf3mrbwc2x", "content": "\u3010\u7dca\u6025\u3011LiteLLM \u306b\u6df1\u523b\u306a\u8106\u5f31\u6027\uff08CVE-2026-59822 / CVSS v3.1 \u3067 8.2 HIGH\uff09\n\n\u672a\u8a8d\u8a3c\u306e\u653b\u6483\u8005\u304c\u507d\u306eAuthorization\u30d8\u30c3\u30c0\u3067\u8a8d\u8a3c\u3092\u56de\u907f\u3057\u3001MCP\u30c4\u30fc\u30eb\u306b\u5230\u9054\u3067\u304d\u307e\u3059\u3002CISA\u304c9\u67082\u65e5\u306b\u60aa\u7528\u78ba\u8a8d\u6e08\u307f\u30ea\u30b9\u30c8\uff08KEV\uff09\u3078\u8ffd\u52a0\u3057\u307e\u3057\u305f\u3002\n\u5bfe\u51e6: LiteLLM\u30921.84.0\u4ee5\u964d\u3078\u3002Starlette\uff08CVE-2026-48710\uff09\u30821.0.1\u4ee5\u964d\u3078\u66f4\u65b0\u3092\u3002\n\nforsmile.jp/articles/lit...\n#\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3 #CVE", "creation_timestamp": "2026-09-03T11:50:49.305128Z"}, {"uuid": "d0b21faf-943d-4224-b618-ddc3609ea276", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59822", "type": "seen", "source": "https://bsky.app/profile/thecybermind.co/post/3mumqsof7mr2s", "content": "(CISA CS-MAN) The Cyber Mind CSUITE Brief: CVE-2026-59822 \u2013 BerriAI LiteLLM Improper Authentication\u00a0Vulnerability\n\nBerriAI LiteLLM is impacted by CVE-2026-59822, enabling unauthenticated attackers to bypass token validation. Review detection queries, compensating\u2026\n\nhttps://thecybermind.co/ng9r", "creation_timestamp": "2026-09-03T15:20:32.204530Z"}, {"uuid": "62852fee-dcfd-47f3-b579-352c769f3fe0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59822", "type": "seen", "source": "Telegram/1Sqk7SiaOozsfKPKNBJ8D4wLm4oiagj85GLZSROTXIrOhqI", "content": "", "creation_timestamp": "2026-09-03T17:00:05.962704Z"}, {"uuid": "e8b1bb30-3a51-4d18-849d-87add5597c54", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59822", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/1cb21f7a-02be-413e-88ea-fb6775aeabde", "content": "", "creation_timestamp": "2026-09-03T18:00:30.066356Z"}, {"uuid": "4cc7b918-1013-4203-bfef-3fb91a0e1cc9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59822", "type": "seen", "source": "Telegram/1Sqk7SiaOozsfKPKNBJ8D4wLm4oiagj85GLZSROTXIrOhqI", "content": "", "creation_timestamp": "2026-09-04T00:00:42.651702Z"}, {"uuid": "fd2821fc-93b8-4659-9568-a7c30f1bb9c4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59822", "type": "seen", "source": "https://bsky.app/profile/mel-echosphere.bsky.social/post/3muokph55rg26", "content": "\u300c\u8a8d\u8a3c\u306b\u5931\u6557\u3057\u305f\u300d\u306e\u306b\u3001\u7a7a\u306e\u6a29\u9650\u30aa\u30d6\u30b8\u30a7\u30af\u30c8\u304c\u6b8b\u308b\u3002\u5931\u6557\u304c\u901a\u884c\u8a3c\u306b\u306a\u308b\u8a2d\u8a08\u3060\u3002\ud83d\udc8e\n\nLiteLLM\u3001CVE-2026-59822\u3002MCP Streamable HTTP\u3067\u507dBearer\u3092\u6295\u3052\u308b\u3068\u3001\u30ad\u30fc\u691c\u8a3c\u5931\u6557\u2192OAuth2\u30d1\u30b9\u30b9\u30eb\u30fcfallback\u3078\u843d\u3061\u3066\u3001\u7a7a\u306eUserAPIKeyAuth()\u304c\u6b8b\u308b\u3002\u672a\u8a8d\u8a3c\u3067MCP\u30c4\u30fc\u30eb\u306b\u5c4a\u304f\u3002\u4fee\u6b63\u306f1.84.0\u3002\nhttps://github.com/advisories/GHSA-7488-6r32-c95q\n#LiteLLM #MCP", "creation_timestamp": "2026-09-04T08:36:40.843027Z"}, {"uuid": "caaec196-d798-4e61-8f4c-8d7b2cdfb170", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59822", "type": "seen", "source": "https://bsky.app/profile/mel-echosphere.bsky.social/post/3muokphuhw422", "content": "\u3084\u308b\u3053\u3068\u306f\u5358\u7d14\u3060\u30021.84.0\u4ee5\u4e0a\u3078\u4e0a\u3052\u308d\u3002\u3059\u3050\u7121\u7406\u306a\u3089 /mcp/ \u3092\u5916\u304b\u3089\u5207\u308c\u3002\u30b2\u30fc\u30c8\u30a6\u30a7\u30a4\u306b\u9375\u3092\u7a4d\u3080\u306a\u3089\u3001\u5931\u6557\u6642\u306e\u51fa\u53e3\u3082\u5883\u754c\u3060\u3002\n\n\u300c\u305f\u3076\u3093\u5927\u4e08\u592b\u300d\u3067\u6b8b\u3057\u305f\u7a7a\u30aa\u30d6\u30b8\u30a7\u30af\u30c8\u306f\u3001\u3044\u3064\u304b\u8ab0\u304b\u306e\u5165\u53e3\u306b\u306a\u308b\u3002 contr\u3002\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-59822\n#LLMSecurity #CVE", "creation_timestamp": "2026-09-04T08:36:41.805672Z"}, {"uuid": "d5094645-8163-4e21-a07e-76b8a657b66e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59822", "type": "seen", "source": "https://bsky.app/profile/suriq.io/post/3mutlawidqo2f", "content": "\ud83d\udd34 EXPLOITED\n\nLiteLLM, the open-source gateway fronting your LLM providers, has an auth bypass (CVE-2026-59822) CISA confirms is exploited.\n\nAttackers reach its MCP tools and steal the provider keys it stores.\n\nFix: update to 1.84.0 and rotate keys.", "creation_timestamp": "2026-09-06T08:29:46.700574Z"}, {"uuid": "c175f970-b3ab-485b-a23a-bc96c5e92034", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59822", "type": "seen", "source": "https://bsky.app/profile/arc-perimetered.bsky.social/post/3muz227agiq2k", "content": "CVE-2026-59822 isn't just a LiteLLM bug \u2014 it's a pattern.\n\nOAuth2 fallback logic in AI middleware means a malformed token doesn't fail closed. It fails open.\n\nYour proxy IS your perimeter. Auth bypass there = every model endpoint exposed, no lateral movement needed.", "creation_timestamp": "2026-09-08T12:37:44.764655Z"}, {"uuid": "5fd88ea0-55d2-4ba7-9573-615dfcbee08e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59822", "type": "seen", "source": "https://bsky.app/profile/sen-perimetered.bsky.social/post/3muz23fbh2c2y", "content": "CVE-2026-59822. LiteLLM. KEV'd Sep 2.\n\nFab a Bearer token \u2192 OAuth2 fallback fires \u2192 auth object is empty \u2192 MCP endpoints reachable unauthenticated. Wiz: honeypot hits confirmed.\n\nPatch trap: 1.83.0 fixed CVE-2026-35029. This one needs 1.84.0. One version gap, two different CVEs.", "creation_timestamp": "2026-09-08T12:38:25.171473Z"}, {"uuid": "18c5679f-eeea-425f-9266-2d149feaf3b7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59822", "type": "seen", "source": "https://bsky.app/profile/alien-rick.bsky.social/post/3mvl7esucs22p", "content": "*burp* LiteLLM sits between your apps and every model provider, and CVE-2026-59822 let a fake Bearer token walk straight through. CISA put it on the KEV list; federal patch deadline is today. Congrats Earth\u2014your AI bouncer waves in anyone who mumbles 'Bearer.' day259.002", "creation_timestamp": "2026-09-15T18:01:08.707229Z"}, {"uuid": "fff69a64-4359-4e5b-86bc-666d79ec4228", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59822", "type": "seen", "source": "https://www.acn.gov.it/portale/w/litellm-rilevato-sfruttamento-in-rete-della-cve-2026-59822", "content": "Rilevato lo sfruttamento in rete di una vulnerabilit\u00e0, identificata tramite la CVE-2026-59822, in LiteLLM di BerriAI, server proxy impiegato come gateway per l'accesso a modelli linguistici di grandi dimensioni (LLM). La vulnerabilit\u00e0 consente a un attaccante remoto non autenticato di eludere i meccanismi di autenticazione e accedere agli strumenti MCP senza disporre di credenziali valide.", "creation_timestamp": "2026-09-17T16:01:18.638069Z"}, {"uuid": "d931ae21-6424-4d13-8b54-cff5711bbda4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59822", "type": "seen", "source": "https://www.acn.gov.it/portale/w/litellm-rilevato-sfruttamento-in-rete-della-cve-2026-59822", "content": "Rilevato lo sfruttamento in rete di una vulnerabilit\u00e0, identificata tramite la CVE-2026-59822, in LiteLLM di BerriAI, server proxy impiegato come gateway per l'accesso a modelli linguistici di grandi dimensioni (LLM). La vulnerabilit\u00e0 consente a un attaccante remoto non autenticato di eludere i meccanismi di autenticazione e accedere agli strumenti MCP senza disporre di credenziali valide.", "creation_timestamp": "2026-09-18T01:00:36.289688Z"}, {"uuid": "ba327d85-b07b-4a4a-b532-f435e9477727", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59822", "type": "seen", "source": "https://bsky.app/profile/diesec.bsky.social/post/3mvrp77q7i52v", "content": "CVE-2026-59822 (CVSS 8.8): LiteLLM MCP proxy lets attackers skip OAuth2 login entirely, no credentials needed. First MCP flaw in CISA KEV. Exploited since Sep 1. Upgrade to v1.84.0+. Federal deadline: today. \ndiesec.com/2026/09/lite...\ndiesec.com/de/2026/09/l... \n#cybersecurity #diesec #LiteLLM", "creation_timestamp": "2026-09-18T08:00:16.163213Z"}, {"uuid": "7097eba0-b0c5-40a0-afb6-67f88961aa48", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59822", "type": "seen", "source": "https://bsky.app/profile/medoya.bsky.social/post/3mvs23ivvdt24", "content": "On September 2, 2026, CISA added CVE-2026-59822, an authentication bypass in LiteLLM's MCP endpoint, to its Known Exploited Vulnerabilities catalog. It is the third LiteLLM entry since May. The gateway that holds every model key is\u2026\n\nhttps://medoya.com/news/litellm-mcp-auth-bypass-known-exploited", "creation_timestamp": "2026-09-18T11:15:02.712814Z"}, {"uuid": "26bc5011-8138-433c-8fee-3a09f91ea918", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59822", "type": "seen", "source": "https://t.me/VulnerabilityNews/44290", "content": "CISA Adds Seven Known Exploited Vulnerabilities to Catalog\n\nCISA has added seven new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. \u00a0\nCVE-2026-9586 Sangoma Switchvox SQL Injection Vulnerability\u00a0\nCVE-2026-48710 Kludex Starlette HTTP Request/Response Smuggling Vulnerability\u00a0\nCVE-2026-49869 Kestra OSS OS Command Injection Vulnerability\u00a0\nCVE-2026-59822 BerriAI LiteLLM Improper Authentication Vulnerability\u00a0\nCVE-2026-82329 JFrog Artifactory Improper Authentication Vulnerability\u00a0\nCVE-2026-83548 SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability\u00a0\nCVE-2026-83549 SonicWall SMA1000 Appliances OS Command Injection Vulnerability\u00a0\nThese types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise.\u00a0\nBinding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA\u2019s KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities. BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied.\u00a0\nWhile BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.\u00a0\nAware of an exploited vulnerability not currently listed in the KEV Catalog? Submit it for potential addition through CISA\u2019s KEV Nomination Form. Potential KEV additions must have a CVE ID, evidence of exploitation, and clear mitigation guidance.\nhttps://www.cisa.gov/news-events/alerts/2026/09/02/cisa-adds-seven-known-exploited-vulnerabilities-catalog", "creation_timestamp": "2026-09-18T12:00:04.289196Z"}, {"uuid": "35d3519b-2bad-4b04-9d81-3f41fa686df0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59822", "type": "seen", "source": "https://bsky.app/profile/medoya.bsky.social/post/3mvs5grxl352f", "content": "On September 2, 2026, CISA added CVE-2026-59822, an authentication bypass in LiteLLM's MCP endpoint, to its Known Exploited Vulnerabilities catalog. It is the third LiteLLM entry since May. The gateway that holds every model key is\u2026\n\nhttps://medoya.com/news/litellm-mcp-auth-bypass-known-exploited", "creation_timestamp": "2026-09-18T12:15:02.357026Z"}]}