You bolted an LLM gateway onto your stack to make AI adoption feel enterprise-grade — centralized keys, clean auth, one throat to choke. Turns out that throat had a loophole, and cryptominers found it before most admins even knew LiteLLM was on their attack surface.
The Fallback Path Nobody Meant to Ship
CVE-2026-59822 lives in LiteLLM's MCP Streamable HTTP endpoint, the increasingly popular open-source proxy that sits in front of LLM providers for companies managing AI usage at scale. Before version 1.84.0, sending a fabricated Authorization header could trigger an OAuth2 passthrough fallback that swapped a failed key check for an empty, unauthenticated auth object — letting requests reach MCP tooling with no valid key at all.
CISA added the flaw to its Known Exploited Vulnerabilities catalog on September 2, 2026, with a CVSS score of 8.8. It's not the only AI-infrastructure bug on the list either — CISA flagged seven vulnerabilities total, including a perfect 10.0 auth bypass in workflow tool Kestra, underscoring how much of the new AI tooling stack is getting stress-tested in production, in real time, by actual attackers.
The Boring Payload Behind the Scary CVE
Here's the plot twist: attackers chained this bypass with a separate Starlette flaw to break into exposed LiteLLM installs and drop XMRig cryptominers. Unglamorous, sure — but the same access lets them read the LiteLLM_ProxyModelTable and LiteLLM_VerificationToken, meaning upstream provider API keys and proxy-issued virtual keys were sitting there for the taking.
That's the part businesses rushing to "add AI" tend to skip — the proxy holding your OpenAI or Anthropic keys is now just as critical as your database, and it needs the same patching discipline, not the "we'll get to it" treatment reserved for a side project.
Cryptomining is the annoying canary in the coal mine; API key theft is the actual explosion waiting to happen.
James here — if your team bolted AI tooling onto the stack faster than your security review could keep up, let's talk about closing that gap at webtechkitchen.com/contact.
Source: SecurityOnline