CISA Flags Critical LiteLLM Auth-Bypass Flaw Actively Exploited
CISA has added CVE-2026-59822, a CVSS 8.8 authentication bypass in the widely used LiteLLM AI gateway, to its Known Exploited Vulnerabilities catalog, warning that attackers can reach protected AI tooling without valid credentials on any unpatched deployment.
A widely used piece of AI infrastructure just landed on the federal government's most urgent watchlist. On September 2, CISA added CVE-2026-59822 to its Known Exploited Vulnerabilities catalog, a CVSS 8.8 authentication bypass affecting LiteLLM, the popular open-source proxy that lets developers route requests to different large language models through a single interface.
The flaw lives in how LiteLLM handles authentication on one specific endpoint, and CISA's language leaves little ambiguity about the stakes: "allows unauthenticated attackers to establish authenticated sessions using arbitrary Bearer tokens." A few key facts about the vulnerability:
- It affects all LiteLLM versions prior to 1.84.0, with a fix already published by maintainer BerriAI
- The bug requires no valid API key, credentials, or user interaction to exploit remotely
- Federal civilian agencies face a September 16 patching deadline under CISA's binding directive on high-risk vulnerabilities
What makes this one sting is where LiteLLM sits in the stack. As an AI gateway sitting in front of connected tooling and upstream services, a successful bypass can expose sensitive material flowing through it — including API keys and backend credentials — without ever needing to breach the applications behind it.
The disclosure also isn't LiteLLM's first appearance in the KEV catalog this year; researchers note it's one of several LiteLLM flaws exploited in 2026, a pattern that underscores how quickly AI infrastructure has become a preferred target as more companies wire these gateways directly into production systems.
