LiteLLM MCP Authentication Bypass: Patch Now

By Editorial Team | September 18, 2026
A LiteLLM MCP authentication bypass lets attackers skip OAuth2 login entirely. Active exploitation confirmed, first MCP flaw in CISA KEV.

A LiteLLM MCP authentication bypass, CVE-2026-59822 (CVSS 8.8), lets an attacker skip OAuth2 login entirely when connecting to Model Context Protocol servers through LiteLLM’s proxy, gaining whatever access an authenticated session would carry. CISA added the flaw to its Known Exploited Vulnerabilities catalog on September 2, the first MCP-related vulnerability ever listed there; WatchTowr reports…

Read More

Ruflo RufRoot CVE-2026-59726: AI Agents Hijacked

By Editorial Team | August 5, 2026
Ruflo RufRoot CVE-2026-59726 (CVSS 10.0) lets attackers hijack AI agents via an unauthenticated MCP bridge exposed to the network by default.

Ruflo RufRoot CVE-2026-59726, a maximum-severity CVSS 10.0 flaw disclosed by Noma Security, lets an unauthenticated attacker take full control of an AI agent platform used by an estimated one million people — through a single HTTP request against a management bridge that ships exposed to the network by default. What Happened Ruflo is an open-source…

Read More