A flaw in a widely used AI proxy is now on the US list of actively exploited bugs

The US Cybersecurity and Infrastructure Security Agency has added seven vulnerabilities to its Known Exploited Vulnerabilities catalogue. One of them is in the AI stack.

CVE-2026-59822, carrying a CVSS score of 8.8, is an authentication bypass in the MCP Streamable HTTP endpoint of LiteLLM — an open-source proxy widely used to sit between applications and the various language model providers they call.

What The Listing Means

The KEV catalogue is a specific claim, and it is stronger than a vulnerability disclosure.

Entries are added when there is reliable evidence of active exploitation in the wild. This is not a researcher's proof of concept or a theoretical attack path — it means someone has been using it. For US federal civilian agencies, KEV inclusion carries a binding remediation deadline, and most large enterprises treat the catalogue as a de facto patch priority list.

Why This Component Matters

LiteLLM is infrastructure most people using it never think about, which is precisely what makes it worth attention.

A proxy of this kind sits at an unusually sensitive point. To do its job it typically holds provider API keys for every model an organisation calls, and it sees the traffic in both directions — the prompts going out and the completions coming back. That traffic frequently contains exactly the material an organisation would least like to lose: internal documents, customer records, source code, credentials pasted into a prompt by someone in a hurry.

An authentication bypass on a component like that is not a peripheral issue. It is access to the keys and the conversation at once.

The Broader Point

This is the part worth generalising, because it will recur.

Enormous attention has gone to whether models themselves can be manipulated — prompt injection, jailbreaks, data extraction from training sets. Far less has gone to the ordinary software assembled around them: proxies, gateways, orchestration layers, vector databases, the connective tissue that turns a model into a product.

That layer is conventional software with conventional vulnerabilities. It has often been adopted very fast, by teams under pressure to ship AI features, with less security review than an equivalently sensitive component would normally receive. And it is frequently open source maintained by a small number of people relative to how widely it has been deployed.

The attack surface of an AI system is not primarily the model. It is everything that was built around the model in a hurry.

What Organisations Should Actually Do

The immediate action is narrow: identify whether LiteLLM is deployed anywhere in the estate, patch it, and rotate every provider API key it held. A bypass that may have exposed stored credentials is not remediated by patching alone.

The broader action is an inventory. Most organisations that adopted AI tooling quickly do not have a clear list of what is sitting in the path between their applications and their model providers, and cannot answer what any of those components hold.

What To Watch

Whether further AI infrastructure components appear in the KEV catalogue in the coming months, which would confirm this as a pattern rather than an incident. Whether the AI tooling ecosystem adopts the disclosure and patching discipline of more mature infrastructure software. And whether enterprises begin treating the model-adjacent stack as security-critical, which most currently do not.