The First MCP Flaw in the KEV Catalog Was an Authentication Check That Failed Open

MCP authentication entered CISA’s Known Exploited Vulnerabilities catalog for the first time on 2 September 2026, and the bug underneath it is the kind every engineer recognizes on sight.

CVE-2026-59822 is an improper authentication flaw in BerriAI LiteLLM, the LLM proxy. The affected surface is its Model Context Protocol streamable HTTP endpoint. The mechanism is one decision made in the wrong direction: when LiteLLM key validation failed, the MCP authentication handler’s OAuth2 passthrough fallback substituted an empty authentication object instead of rejecting the request. So a request carrying any invented bearer token was treated as authenticated.

We have covered what the Model Context Protocol is and how CMS teams should scope MCP agent permissions. This is the first time the protocol layer itself has shown up in a catalog that only lists vulnerabilities with evidence of active exploitation.

The short version: the flaw is ordinary, the location is not, and the pattern it belongs to is older than most coverage suggests. AI tooling has been in the KEV catalog since May 2025. What is new here is that the failure is in the layer agents use to reach their tools, rather than in a tool.

What the mcp authentication flaw actually let an attacker do

Scoped precisely, because the scope is smaller than the headline suggests and still bad.

CISA’s entry describes an unauthenticated attacker establishing an authenticated MCP session using an arbitrary bearer token. The vendor advisory scopes the impact to listing and calling configured MCP tools and reaching the services exposed through them.

Provider API key exposure is not in the documented impact. That matters, because the obvious assumption about a compromised LLM proxy is that your model credentials walk out the door, and for this CVE that is not what the advisory says. Confidentiality is rated high because of what the MCP tools can reach, not because keys are dumped.

The credential angle is real, but it belongs to a different LiteLLM bug. CVE-2026-42208, a SQL injection added to KEV on 8 May 2026, is described as allowing an attacker to read and potentially modify the proxy’s database, leading to unauthorized access to the proxy and the credentials it manages. If you are making the case that an LLM proxy is a credential store wearing a router costume, that is the citation.

Affected versions are below 1.84.0 and the fix is 1.84.0. The severity scores disagree depending on who you ask, 8.8 from the GitHub advisory under CVSS 4.0 and 8.2 from NVD under CVSS 3.1, so name your source if you quote one. CISA set a remediation due date of 16 September 2026, which has now passed.

The same batch contained a worse bug and a documented chain

Two other entries from 2 September deserve attention, and one of them makes an argument this piece was going to have to make on its own.

Kestra scored a 10.0. CVE-2026-49869 in Kestra OSS, the workflow orchestrator, is filed as command injection, but the root cause is a path check. Its authentication filter whitelisted the public config endpoint using a suffix match, testing whether the request path ends with /configs rather than comparing the path exactly. Any endpoint whose final segment is configs therefore skipped authentication entirely, including routes that create flows, execute flows and delete logs.

An attacker creates a workflow, runs it through the script plugins that are enabled by default, and gets remote code execution as root in the worker container, plus server-side request forgery against internal networks and cloud metadata endpoints. CISA gave it a three-day remediation deadline.

Suffix matching on a path is the same class of mistake as the LiteLLM fallback. Both are an authorization decision written so that the unexpected case passes.

And CISA documented a chain. The Starlette entry from the same day, CVE-2026-48710, a request smuggling flaw, carries a note in CISA’s own catalog text saying it could be chained with CVE-2026-42271. That CVE is the LiteLLM command injection added to KEV in June 2026.

Starlette is the ASGI layer that FastAPI sits on, which is most Python model-serving in production. So the catalog is now describing, in its own prose, a route from a general-purpose web framework into an LLM proxy. Nobody had to construct that argument. CISA wrote it down.

The pattern is not new, it is accelerating

This is where most coverage of AI tooling security goes wrong, including the version of this article we nearly wrote.

The tempting claim is that the AI stack has started producing actively exploited vulnerabilities. It is not true. AI tooling entered the KEV catalog on 5 May 2025 with CVE-2025-3248 in Langflow, a missing authentication check on a code validation endpoint that yielded unauthenticated remote code execution. Eleven AI stack entries predate the September 2026 one.

The distribution is worth seeing laid out.

Langflow accounts for six. LiteLLM accounts for three. These are repeat entries in the same products, not a scattering of first-timers.

Two things follow from reading it honestly. September was not a spike. August had three AI stack additions and September had one, so anyone describing last month as a surge is describing the shape of their own attention. And the trend is genuinely upward: nothing between May 2025 and March 2026, then something close to monthly.

For scale, of the 23 KEV additions in September 2026, exactly one is unambiguously an AI-specific product. Three at the most generous reading, adding Kestra and Starlette. The other twenty are ordinary enterprise infrastructure: Citrix, Cisco, Fortinet, MikroTik, Microsoft, Chromium, JFrog, SonicWall, Adobe, GitLab, ConnectWise, N-able and Sangoma. The AI stack is a small and growing share of exploited vulnerabilities, not a flood.

What makes this month distinctive is the kind of flaw, not the volume. It is the first one in the protocol that agents use to reach tools.

The shape these bugs keep taking

Set the twelve entries side by side and the same few failure modes keep appearing, which is more useful than any individual CVE.

Authentication that fails open. The LiteLLM MCP fallback and the Kestra suffix match are both an auth check whose unexpected branch grants access. In mature software the unexpected branch denies.

Code execution as a feature. Langflow validates code. n8n evaluates expressions. Kestra runs scripts. Ray executes tasks. In each case the product’s purpose is to run code someone supplied, so the entire security model reduces to the authorization check in front of it. When that check fails, there is no second line.

Privileged position, thin review. These components sit between agents and the systems agents act on. They hold API keys, database connections and cloud roles. And most of them are young projects that grew fast because demand was enormous.

We made the credential version of this argument in the Langflow vulnerability piece and again from a different direction in the npm supply chain piece. Those two plus this one is a third data point, which is the threshold at which it stops being a run of incidents and becomes a property of the category.

Two more from the same weeks fit the shape without being AI products. JFrog Artifactory, CVE-2026-82329, registered an empty string as a valid signing secret when a configuration key was left unset, so an attacker could hash the empty string and forge an administrator token. That is failing open again, and an attacker with Artifactory admin can retrieve the credentials it uses to reach upstream registries and publish artifacts under trusted names. And in Drupal, SA-CONTRIB-2026-134 is a critical SQL injection in the amazee.ai Private AI Provider module, where filter values are not sanitized before being used to build queries against a Postgres and pgvector backend. Drupal raised the score on 11 September to reflect publicly documented exploit methods. It needs the pgvector backend in use and a non-string field exposed as a filter, so it is rated complex to exploit rather than trivially scannable.

What to do this week

Check whether you run any of these, including indirectly. LiteLLM below 1.84.0, Kestra at or below 1.3.20, Langflow in almost any version, Ray, MLflow, n8n. The indirect case is the one that catches people, because these arrive as a dependency of a platform someone evaluated rather than as a decision anyone made.

Find out what your MCP endpoints are exposed to. The LiteLLM flaw only matters in proportion to what the configured tools can reach. An MCP server wired to a read-only documentation search is a different incident from one wired to your CMS, your ticketing system and a cloud role. That inventory is the work, and we walked through how to scope it in CMS MCP agent permissions.

Treat a proxy as a credential store. LiteLLM holds provider keys. Artifactory holds upstream registry credentials. Kestra holds whatever its flows connect to. Back these with the controls you would put on a secrets manager, not the ones you would put on a router.

Read your own auth fallbacks. The specific question worth asking of your codebase this week is what happens when validation fails rather than when it succeeds. Both flaws here answered that question with "continue."

Subscribe to the KEV catalog rather than waiting for coverage. Everything in this piece was public in CISA’s data, with due dates, before any of it was written up. For a small team it is the highest-value security feed available, and it is free.

Frequently Asked Questions