BerriAI LiteLLM contains an improper authentication vulnerability in the MCP Streamable HTTP endpoint that could allow an unauthenticated attacker to…
BerriAI LiteLLM contains an improper authentication vulnerability in the MCP Streamable HTTP endpoint that could allow an unauthenticated attacker to establish an authenticated MCP session using an arbitrary Bearer token.
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- OpenAI
- Product
- ChatGPT / OpenAI, AI / LLM tooling
- CISA KEV
- listed
- Exploitation
- observed in the wild
- Fix
- available
- Exposure class
- AI infrastructure
Why it ranks 50 (Critical)
- CISA KEV listed
- Product class: AI infrastructure
- Fix available
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
- CVE-2026-59822 on this site · NVD · CVE.org · Vulnpedia · KEV
Related coverage
Other items that share a CVE or were clustered with this one.