Improper Authentication in BerriAI LiteLLM (CVE‑2026‑59822) Enables Unauthorized Session Hijacking
What It Is – BerriAI LiteLLM contains an improper authentication flaw in its MCP Streamable HTTP endpoint. An unauthenticated attacker can present any arbitrary Bearer token and the server will establish an authenticated MCP session.
Exploitability – The vulnerability is publicly disclosed (CVE‑2026‑59822) and can be exploited without prior access; a proof‑of‑concept exists in the advisory. No CVSS score is published yet, but the impact of arbitrary session takeover is considered high.
Affected Products – BerriAI LiteLLM (all versions prior to the vendor‑released fix).
Why It Matters for Trust & Control Assurance
- Demonstrates the need for strong identity‑and‑access‑control policies that are continuously monitored and auditable.
- Highlights gaps in authentication logging; without reliable logs, organizations cannot prove that only authorized tokens were used.
- Enterprise buyers increasingly demand defensible evidence that third‑party AI components enforce proper credential validation, a core control that maps to many frameworks (e.g., NIST CSF 2.0 Protect).
Recommended Actions
- Apply the vendor‑issued patch for CVE‑2026‑59822 immediately.
- Rotate all Bearer tokens used with LiteLLM and enforce short‑lived tokens where possible.
- Enable strict logging of MCP session creation and token validation events; integrate logs into a SIEM for continuous monitoring.
- Review IAM policies to ensure least‑privilege token issuance and consider MFA for token‑generating services.
- Document the remediation steps as evidence of control remediation for audit purposes.
Source: CISA KEV – CVE‑2026‑59822