CVE
CVE-2026-59822, CVE-2026-48710
CWE
CWE-287, CWE-306, CWE-436
Affected Surface
- LiteLLM `litellm < 1.84.0` with exposed MCP Streamable HTTP routes
- Starlette `<= 1.0.0`, plus downstream FastAPI and other Python services that rely on `request.url.path` for security decisions
Welcome to Corgea’s weekly briefing. The briefing covers the most important security findings and research from the week.
This edition covers research and exploitation updates surfaced between Tuesday, 2 September and Saturday, 5 September 2026, excluding issues already covered in the 1 September briefing.
Top Article
CVE-2026-59822: LiteLLM MCP auth fallback turns any Bearer token into a session
The highest-signal change in the window is CISA’s 2 September KEV addition for CVE-2026-59822. LiteLLM’s bug was disclosed earlier in the summer, but the KEV move is what changes triage priority for AppSec teams. The vulnerable branch in process_mcp_request() treated a failed LiteLLM API-key validation on Authorization: Bearer ... as an OAuth2 passthrough case and created an empty UserAPIKeyAuth() object instead of stopping the request. That is a small control-flow mistake with a large blast radius in environments where LiteLLM is the broker for MCP servers that can touch source control, tickets, cloud APIs, or internal admin surfaces.
The patched version, 1.84.0, now makes the missing check explicit: fallback is allowed only when the targeted MCP server is actually configured for auth_type=oauth2. If the target cannot be resolved, or if any target is not OAuth2-backed, the request fails closed. Read the full analysis in the LiteLLM article.
More news
CVE-2026-48710: Starlette lets a forged Host header lie about request.url.path
The second issue worth fresh coverage is Starlette’s CVE-2026-48710, also added to KEV on 2 September. This one matters because the vulnerable behavior sits below application code. Starlette rebuilt request.url from f"{scheme}://{host_header}{path}" without validating Host, which meant a header like example.com/abc?bar= could make request.url.path become /abc while routing still dispatched the real /foo. Middleware that trusted request.url.path for access control could therefore authorize one path while the framework executed another.
That split reaches more than Starlette itself. FastAPI and other downstream Python services inherit the same request object semantics, and X41’s public proof of concept shows the bypass in only two curl commands. The fix in 1.0.1 is short and easy to reason about: validate Host against a strict regex and ignore malformed values when reconstructing the URL. The deeper write-up is in the new Starlette article.
Other news
- Our scan of the requested Aikido, Wiz, Socket, and Endor Labs feeds did not surface a separate package-registry compromise or Linux zero-day first published in the 2-5 September window that justified a duplicate Corgea article. Those feeds were heavier on follow-up analysis, product announcements, or items we already cover, such as earlier LiteLLM, Dirty Frag, and supply-chain worm reporting.
- If you are still triaging package-manager risk from the end of August, the most relevant recent carry-over remains CVE-2026-82392 and CVE-2026-82393 in pnpm. It falls just outside this briefing window, so it is better treated as adjacent context than as a new 2-5 September finding.
- For Linux host-boundary context, revisit Dirty Frag, Fragnesia, and CVE-2026-53362. Aikido’s featured Dirty Frag post this week is useful, but the underlying vulnerability family is already covered in Corgea’s existing research archive.
From research to remediation
Check whether this pattern exists in your codebase
Turn this research into a remediation workflow. Scan dependencies and package manifests for similar supply-chain risk, then prioritize fixes with reachability context.