First MCP vulnerability hits CISA KEV list: LiteLLM auth bypass is being exploited in the wild
A milestone nobody wanted: a Model Context Protocol implementation is now on the CISA Known Exploited Vulnerabilities catalog. LiteLLM — the open-source proxy that routes traffic between apps and LLMs — fails authentication on its MCP Streamable HTTP endpoint: any arbitrary bearer token (researchers demonstrated the single letter "a") is accepted, converted internally from a 401 into a valid session. Chained with a separate root-level RCE (CVE-2026-59821, unrestricted exec() in custom code guardrails), pre-auth root on the model gateway is achievable.
Wiz scanned 3,074 internet-exposed LiteLLM instances: 9.6% (295) accept the default master key "sk-1234" or need no auth at all. LiteLLM sits in roughly a third of cloud environments — it is the plumbing most teams never think about, which is exactly why it ended up on a list of vulnerabilities criminals actively use.
Why this entry matters beyond one proxy: KEV listing means federal agencies are required to patch on a clock, and exploitation is confirmed in the wild — not theoretical. The MCP layer of the AI stack just crossed from "researchers warn about" to "attackers monetize." The pattern repeats across the ecosystem: Kotlin SDK denial-of-service advisories, ssh-mcp's read-only classifier bypass rated 9.9, Argo CD's MCP server handing sessions to anyone who could reach it. Different projects, same root cause — the deployment layer of MCP has no owner.
What to do today, no hype: if you run LiteLLM, upgrade past both CVEs and rotate any master key that has ever been default; if you expose MCP endpoints, run an unauthenticated-handshake test against your own surface before someone else's scanner does it for you; and treat every tool description a server hands your agent as attacker-controlled input until proven otherwise.
MCP Flaw Tracker — the week in full
The story of the week is systemic, not singular: independent researchers published evidence that Model Context Protocol has a “by design” architectural weakness enabling AI supply-chain attacks — and Anthropic publicly declined to treat it as a vulnerability.
1. Anthropic won't own MCP 'design flaw' putting 200K servers at risk — The Register (16 Sep, via GNews)
Link: https://news.google.com/search?q=Anthropic+won%27t+own+MCP+design+flaw+200K+servers
Researchers argue MCP's tool-description model lets a malicious or compromised server steer agent behavior across connected clients. Anthropic's position: expected behavior, not a bug. Why builders care: nobody is coming to save your deployment — treat every tool description as attacker-controlled input, pin server versions, and audit what you connect.
2. “By Design” Flaw in MCP Could Enable Widespread AI Supply Chain Attacks — SecurityWeek; Systemic Flaw Could Expose 150 Million Downloads — Infosecurity Magazine (via GNews)
Link: https://news.google.com/search?q=MCP%20design%20flaw%20supply%20chain
Two independent outlets framed the same mechanism as a supply-chain amplifier: one poisoned server reaches every client that trusts it. The 150M download figure is the blast radius of the popular MCP server packages.
3. Ruflo MCP Flaw Lets Unauthenticated Attackers Run Commands and Poison AI Memory — The Hacker News (via GNews)
Link: https://news.google.com/search?q=Ruflo+MCP+flaw
The theoretical became concrete this week: a shipped MCP server with unauthenticated command execution and agent-memory poisoning. This is the deployment-layer failure mode in the wild, not a paper threat.
4. Microsoft & Anthropic MCP servers at risk of RCE, cloud takeovers — Dark Reading; RCE by design: MCP architectural choice haunts AI agent ecosystem — CSO Online; Unpatched AI flaw poses risk to banking sector — American Banker (via GNews)
Link: https://news.google.com/search?q=MCP+RCE+cloud+takeover
Enterprise coverage caught up: finance pages read like the flaw is a banking-operations problem now, not a dev-toy problem.
Tracker data point (ours, measured 15–16 Sep): our FlowSentry scan corpus already matched this pattern before the wave: 44% of 100 public MCP servers had security findings, and this week we caught a live commercial x402 endpoint silently pointed at Sepolia testnet — protocol fine, deployment broken. The MCP story is not “the protocol is bad”; it's nobody owns the deployment layer. That's the gap we work in → see services on a0flow.com.
Sources & further reading:
Wiz disclosure coverage · KEV analysis · Live CVE tracker · Full Issue #001