CISA adds LiteLLM to the KEV catalog: MCP auth bypass under active exploitation
In one sentence On September 2 CISA added seven flaws to the Known Exploited Vulnerabilities catalog, including LiteLLM CVE-2026-59822: an authentication bypass on the MCP endpoint that accepts sessions with an arbitrary Bearer token. Starlette and Kestra OSS are in the same batch.
The US cybersecurity agency CISA keeps a list of flaws that attackers are already using in the wild. On September 2, 2026 it added seven, and one of them is LiteLLM, a widely used piece of software that sits between applications and the AI models they call.
The problem is in the part of LiteLLM that handles MCP, the protocol AI agents use to call external tools. An attacker could show up with a made-up access token and, instead of being rejected, get let in: from there they could list and use the connected tools.
The same batch includes Starlette (the base of many Python web services, FastAPI among them) and Kestra, a workflow automation platform. The practical message is simple: anyone exposing these services to the Internet should update now.
Companies
CISA, BerriAI, Kestra, JFrog
Tools
LiteLLM, Starlette, Kestra
Tags
Sources