The Exploit Bulletin — Thursday, September 3, 2026: 2 issues require action
Thursday, September 3, 2026 — 2 issues require action. If you run none of the software below, you are done.
Affects: BerriAI litellm · Kludex starlette · Red Hat AI Inference Server images
1. Unauthenticated MCP session establishment via arbitrary Bearer token in LiteLLM Streamable HTTP endpoint (CVE-2026-59822)
CISA KEV (due 2026-09-16) · AUTHENTICATION BYPASS · HIGH · CVSS 8.8
CISA placed this flaw in KEV on 2026-09-02 following Wiz honeypot observations of attacks against LiteLLM, and any exposed LiteLLM proxy below 1.84.0 lets an unauthenticated caller open an authenticated MCP session with an arbitrary Bearer token.
LiteLLM versions before 1.84.0 fail to properly validate credentials on the MCP Streamable HTTP endpoint, so an attacker who presents any Bearer token can establish an authenticated MCP session. This gives unauthenticated access to the tools and data exposed through the proxy's MCP integration.
Affected: BerriAI litellm < 1.84.0
How to Test: Check the running LiteLLM version (pip show litellm or the container image tag); anything below 1.84.0 is affected. Confirm whether the MCP Streamable HTTP endpoint is enabled and reachable from untrusted networks. Review proxy access logs for MCP session requests carrying Bearer tokens that do not correspond to any issued key.
How to Patch: Upgrade LiteLLM to 1.84.0 or later (release https://github.com/BerriAI/litellm/releases/tag/v1.84.0, fix in PR 26463). If you cannot upgrade immediately, block external access to the MCP Streamable HTTP endpoint at the network or reverse-proxy layer, or disable the MCP integration, and rotate any credentials reachable through MCP tools.
Evidence: CISA KEV · VulnCheck KEV · CISA adds CVE-2026-59822 to the Known Exploited Vulnerabilities catalog (2026-09-02) · CISA SSVC: active · Wiz Threat Research honeypot telemetry showing sustained attacks on LiteLLM and other AI services (2026-08-27)
2. HTTP request smuggling via host-part path injection bypasses path-based authentication in Starlette (CVE-2026-48710)
CISA KEV (due 2026-09-16) · AUTHENTICATION BYPASS · HIGH · CVSS 6.5
CISA added this flaw to KEV on 2026-09-02 with a 2026-09-16 remediation deadline, and any Starlette or FastAPI service whose authentication decisions depend on the reconstructed URL path remains open to unauthenticated bypass until upgraded.
Starlette versions before 1.0.1 allow an attacker to inject path components into the host portion of a request so that they are prepended to the actual path when the URL is reconstructed. Where authentication or authorization logic keys off that reconstructed path, an unauthenticated attacker can reach protected routes; the issue can be chained with CVE-2026-42271.
Affected: Kludex starlette < 1.0.1; Red Hat AI Inference Server images prior to 3.3.5 (CUDA and ROCm)
How to Test: Run pip show starlette (or inspect your lockfile / container SBOM) in every Python service and FastAPI application; any version below 1.0.1 is vulnerable. Identify middleware or dependencies that make authentication decisions from the reconstructed request URL path. Review access logs for requests carrying path-like content in the Host header or unusual host/path combinations hitting authenticated routes.
How to Patch: Upgrade starlette to 1.0.1 or later and redeploy affected services; for Red Hat AI Inference Server, move to the 3.3.5 images published in RHSA-2026:30089 (CUDA) and RHSA-2026:30088 (ROCm). Until upgraded, enforce authentication at a reverse proxy or gateway that does not depend on the application's reconstructed URL, and reject requests with malformed Host headers at the edge.
Evidence: CISA KEV · VulnCheck KEV · CISA adds CVE-2026-48710 to the Known Exploited Vulnerabilities catalog (2026-09-02) · CISA SSVC: active · Microsoft: attacks on AI gateways and control points (2026-08-26) · Wiz Threat Research honeypot telemetry on AI infrastructure attacks (2026-08-27)
Read on the web · Every past edition
The Exploit Bulletin is free and daily. It publishes only what security teams must act on today — nothing else. Forward it freely.
Spot an error, or an exploit we missed? Reply here or email [email protected].
