{"vulnerability": "CVE-2026-5982", "sightings": [{"uuid": "9b23e8ec-b8af-486d-b830-9d7182238ff4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5982", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mj3tnfvkoj2j", "content": "", "creation_timestamp": "2026-04-09T22:18:52.858099Z"}, {"uuid": "21700acf-e7f2-4e04-aa29-0d098ca79b90", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5982", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mj4nuimvz72j", "content": "", "creation_timestamp": "2026-04-10T06:08:09.671096Z"}, {"uuid": "6a8d66f7-6b89-4d55-a01e-45797e1ff651", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5982", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mj4nvdflqs2h", "content": "", "creation_timestamp": "2026-04-10T06:08:36.351923Z"}, {"uuid": "0c2c59f7-00cd-4104-bc0d-fb2350366219", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5982", "type": "published-proof-of-concept", "source": "Telegram/jvxENlxS5zD0hLDn-51kxH7F1GhkNHxv_GXTHS6t1bT7Jtk", "content": "", "creation_timestamp": "2026-04-09T23:30:56.000000Z"}, {"uuid": "38c55c7c-b7df-4323-bc3a-46900b77e4ad", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5982", "type": "seen", "source": "Telegram/aaKaZzhZCQTbBESVtGmK3HO5aOAiXiyEGsKbx2XTc93AVKM", "content": "", "creation_timestamp": "2026-04-09T23:30:50.000000Z"}, {"uuid": "6ea56454-053d-40cf-b7fc-f5a97b11107d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5982", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mmqibwr4hx25", "content": "\ud83d\udccc CVE-2026-5982 - A vulnerability was found in D-Link DIR-605L 2.13B01. This vulnerability affects the function formAdvNetwork of the file /goform/formAdvNetwork of the... https://www.cyberhub.blog/cves/CVE-2026-5982", "creation_timestamp": "2026-05-26T07:37:06.395018Z"}, {"uuid": "6d87711f-7a9b-4ff9-b389-42b3aa85ef92", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59827", "type": "seen", "source": "Telegram/9qYdJNeZ50siptVHrqc-g91N4K0CPGozDwGl0Etd8sr4-fM", "content": "", "creation_timestamp": "2026-08-15T08:00:07.109579Z"}, {"uuid": "3acd1104-2561-4d97-8df1-224d479bba62", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59822", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mq63fj6aid2g", "content": "CVE-2026-59822 - LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback\nCVE ID : CVE-2026-59822\n \n Published : July 8, 2026, 8:16 p.m. | 58\u00a0minutes ago\n \n Description : LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1...", "creation_timestamp": "2026-07-08T21:39:18.889161Z"}, {"uuid": "c4d9ee70-89db-4d93-b067-9856c71e6771", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-59822", "type": "seen", "source": "https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-59822", "content": "", "creation_timestamp": "2026-07-09T00:15:14.416515Z"}, {"uuid": "581c2815-106c-4f55-921b-6a157b466587", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-59820", "type": "seen", "source": "https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-59820", "content": "", "creation_timestamp": "2026-07-09T00:15:16.890153Z"}, {"uuid": "bda1fb1b-a6dc-4ad6-9584-4d4675d0632f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-59821", "type": "seen", "source": "https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-59821", "content": "", "creation_timestamp": "2026-07-09T00:15:19.180104Z"}, {"uuid": "ef300704-8cd9-430c-896a-24cb484cb251", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59827", "type": "published-proof-of-concept", "source": "Telegram/9qYdJNeZ50siptVHrqc-g91N4K0CPGozDwGl0Etd8sr4-fM", "content": "", "creation_timestamp": "2026-08-16T00:00:22.193351Z"}, {"uuid": "f48d48f2-fc7d-45f9-876b-d3c8436feb49", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59827", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mqab2wousj2w", "content": "CVE-2026-59827 - metabase\nMetabase business intelligence tool is affected. If an attacker can run H2 database queries, they may be able to execute code on the server. Update to version 1.58.15, 1.59.12, 1.60.6.3, or\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#metabase #CVE #infosec", "creation_timestamp": "2026-07-09T18:26:05.800383Z"}, {"uuid": "c3af38e5-f0e6-4a75-9352-6d932fba8f51", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59826", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mqab6hpfet2r", "content": "CVE-2026-59826 - metabase\nAn authenticated administrator can run unauthorized code on your Metabase server. This is a risk because it could be used to steal sensitive data or disrupt your business. To protect\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#metabase #CVE #infosec", "creation_timestamp": "2026-07-09T18:28:04.385470Z"}, {"uuid": "58316356-8c5f-4e24-9283-163ed5d5c406", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59826", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mqabz6y7ax27", "content": "CVE-2026-59826 - Metabase: Arbitrary Code Execution via Database Connection Detail Bypass\nCVE ID : CVE-2026-59826\n \n Published : July 9, 2026, 6:16 p.m. | 15\u00a0minutes ago\n \n Description : Metabase is an open-source business intelligence and embedded analytics tool. From 1.55.0 ...", "creation_timestamp": "2026-07-09T18:43:01.085609Z"}, {"uuid": "20183eb3-8d6e-4d4c-bb3e-7242cdeb1abb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59827", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mqadsdolzn2x", "content": "CVE-2026-59827 - Metabase: Unsafe Deserialization of H2 Query Results\nCVE ID : CVE-2026-59827\n \n Published : July 9, 2026, 6:16 p.m. | 15\u00a0minutes ago\n \n Description : Metabase is an open-source business intelligence and embedded analytics tool. Prior to 1.58.15, 1.59.12, 1.60....", "creation_timestamp": "2026-07-09T19:14:58.553296Z"}, {"uuid": "bd8a9b11-0774-4d94-90ed-8c5c0fa63335", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59828", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mqawjvldsi2e", "content": "CVE-2026-59828 - Discourse: Hidden post revisions leak through adjacent visible diffs\nCVE ID : CVE-2026-59828\n \n Published : July 9, 2026, 10:17 p.m. | 1\u00a0hour, 31\u00a0minutes ago\n \n Description : Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4....", "creation_timestamp": "2026-07-10T00:50:16.498337Z"}, {"uuid": "ad50880e-c55f-4bcf-b387-df8062353a1f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59821", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mqk5pel3hu2d", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-59821 \u0432 LiteLLM: \u0443\u0433\u0440\u043e\u0437\u044b \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/62382D3D-9A2F-403E-A2CB-5D22D75F45A2", "creation_timestamp": "2026-07-13T16:52:33.679397Z"}, {"uuid": "9b2fb243-f117-4359-b700-037357f6aafa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59822", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mqk5qc4l5s2f", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-59822 \u0432 LiteLLM: \u0443\u0433\u0440\u043e\u0437\u044b \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/97FC7B77-8936-4785-9E19-4BE50D758738", "creation_timestamp": "2026-07-13T16:53:04.512282Z"}, {"uuid": "8f41b486-70b3-44c5-a1fc-180c84c8fde9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59820", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mqk5rxa4vk2f", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-59820 \u0432 LiteLLM: \u0443\u0433\u0440\u043e\u0437\u044b \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/E0180BA2-776A-4B6C-A745-167369BFE20E", "creation_timestamp": "2026-07-13T16:54:00.243840Z"}, {"uuid": "5e5e61c0-e284-4b3a-9ce0-5a47a013aa95", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59827", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mqkd7khczo2s", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-59827 \u0432 Metabase: \u0443\u0433\u0440\u043e\u0437\u044b \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/62A14CD4-C1C7-4933-855C-DF268222F41F", "creation_timestamp": "2026-07-13T18:31:05.467705Z"}, {"uuid": "344ad77e-5ec2-43c8-ac8e-9cc5796437fb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59827", "type": "seen", "source": "https://bsky.app/profile/qiancx.bsky.social/post/3mqkd7mgmhl2l", "content": "Metabase \u5b89\u5168\u6f0f\u6d1e CVE-2026-59827 \u6df1\u5ea6\u89e3\u6790:\u5f71\u54cd\u3001\u4fee\u590d\u4e0e\u9632\u62a4\u6307\u5357\n\n\n\nhttps://qian.cx/posts/A9F7B94D-FA8B-41FB-B1CC-46944F125B05", "creation_timestamp": "2026-07-13T18:31:09.278357Z"}, {"uuid": "e39da782-285c-47ab-9b1e-362f72920497", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59827", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mql4oy2fa427", "content": "\ud83d\udccc CVE-2026-59827 - Metabase is an open-source business intelligence and embedded analytics tool. Prior to 1.58.15, 1.59.12, 1.60.6.3, and 1.61.1.4, Metabase instances wi... https://www.cyberhub.blog/cves/CVE-2026-59827", "creation_timestamp": "2026-07-14T02:07:06.625145Z"}, {"uuid": "dcfc8d06-4320-4adf-8fb4-3e054ca342a6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59822", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mqlf37gpl52g", "content": "\ud83d\udccc CVE-2026-59822 - LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.84.0, LiteLLM's MCP Streamable HTTP endpoint allowed ... https://www.cyberhub.blog/cves/CVE-2026-59822", "creation_timestamp": "2026-07-14T04:37:07.003172Z"}, {"uuid": "4e588f56-24c0-494b-8411-8d3a0f5ab43c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59821", "type": "seen", "source": "https://bsky.app/profile/khesefxyz.bsky.social/post/3mqqrj4denr2i", "content": "\u05d4\u05ea\u05e7\u05e4\u05ea CVE-2026-59821 \u05d1-LiteLLM: \u05de\u05d4 \u05d6\u05d4, \u05db\u05d9\u05e6\u05d3 \u05d4\u05d5\u05d0 \u05e4\u05d5\u05d2\u05e2, \u05d5\u05de\u05d4 \u05dc\u05e2\u05e9\u05d5\u05ea?\n\n\n\nhttps://khesef.xyz/posts/28372459-15A6-429B-AD3F-8D400671E8AA", "creation_timestamp": "2026-07-16T08:02:57.342418Z"}, {"uuid": "7f240849-64d8-4772-9fbc-1b5d76e4f4cb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59822", "type": "seen", "source": "https://bsky.app/profile/khesefxyz.bsky.social/post/3mqqrjafjkc2t", "content": "\u05d4\u05e1\u05db\u05e0\u05d4 \u05d4\u05d7\u05d3\u05e9\u05d4: CVE-2026-59822 \u05d1-LiteLLM - \u05de\u05d4 \u05d6\u05d4 \u05d0\u05d5\u05de\u05e8 \u05dc\u05da?\n\n\n\nhttps://khesef.xyz/posts/B9006641-8BD6-406F-B400-29F44EA8A950", "creation_timestamp": "2026-07-16T08:03:01.403720Z"}, {"uuid": "a6342196-ead4-4aab-9cca-31a14804dc4a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59827", "type": "seen", "source": "https://bsky.app/profile/khesefxyz.bsky.social/post/3mqqro4gb6m2y", "content": "\u05d7\u05e9\u05d9\u05e4\u05d4: \u05e4\u05d2\u05d9\u05e2\u05d4 \u05e7\u05e9\u05d4 \u05d1-Metabase - CVE-2026-59827 - \u05de\u05d4 \u05d6\u05d4 \u05d0\u05d5\u05de\u05e8 \u05dc\u05da?\n\n\n\nhttps://khesef.xyz/posts/24956843-CF56-4EC6-9DCB-DFA6AB266993", "creation_timestamp": "2026-07-16T08:05:44.806588Z"}, {"uuid": "aef3d2f6-8b0a-434d-938e-4731615b7977", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59827", "type": "seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mqrfplvkz42i", "content": "Metabase patched CVE-2026-59827 (CVSS 9.9) and CVE-2026-59826 (CVSS 9.1). These flaws enable remote code execution via unsafe H2 deserialization.\n\n#Metabase #RCE #CVE202659827 #Deserialization #H2Database", "creation_timestamp": "2026-07-16T14:04:29.832749Z"}, {"uuid": "17affe2c-d57e-4785-9217-ad5a573abedd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59826", "type": "seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mqrfplvkz42i", "content": "Metabase patched CVE-2026-59827 (CVSS 9.9) and CVE-2026-59826 (CVSS 9.1). These flaws enable remote code execution via unsafe H2 deserialization.\n\n#Metabase #RCE #CVE202659827 #Deserialization #H2Database", "creation_timestamp": "2026-07-16T14:04:29.903804Z"}, {"uuid": "aa582909-1652-4d35-a344-8895d68c4786", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59827", "type": "seen", "source": "https://t.me/GithubRedTeam/94788", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #Vulnerability Scanner\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-59827\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a pickl31\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-23 08:46:45\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nMetabase CVE-2026-59827 Vulnerability Scanner\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-23T10:00:02.626883Z"}, {"uuid": "af51a784-865e-4a2c-8c9b-5539c80320f3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59827", "type": "seen", "source": "https://t.me/GithubRedTeam/94788", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #Vulnerability Scanner\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-59827\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a pickl31\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-23 08:46:45\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nMetabase CVE-2026-59827 Vulnerability Scanner\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-24T00:00:09.430283Z"}, {"uuid": "ac1b4bf0-07bb-4716-af5d-8c013b03588a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59822", "type": "seen", "source": "https://bsky.app/profile/cvesentinel.bsky.social/post/3mukhktpfyz2b", "content": "\ud83d\uded1 CVE-2026-59822\nBerriAI LiteLLM\nCVSS 8.8 / EPSS 1% / KEV: No\nTL;DR: LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior\u2026\nhttps://cvesentinel.com/report/CVE-2026-59822?utm_source=bluesky&utm_medium=social&utm_campaign=cvesentinel\n#infosec #CVE #vulnerability", "creation_timestamp": "2026-09-02T17:29:45.722599Z"}, {"uuid": "e44a51ff-7c46-456c-8f07-647af4adb013", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59822", "type": "seen", "source": "https://bsky.app/profile/csirts.com/post/3mukj5h2uw323", "content": "\ud83d\udea8 Added to CISA KEV \u2014 actively exploited:\nCVE-2026-59822: BerriAI LiteLLM Improper Authentication Vulnerability\n\nhttps://www.csirts.com/cve/CVE-2026-59822", "creation_timestamp": "2026-09-02T17:58:03.766357Z"}, {"uuid": "5a8643bb-1d0f-416f-b18e-cefc1a86cddb", "vulnerability_lookup_origin": "405284c2-e461-4670-8979-7fd2c9755a60", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59822", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/b2e0c044-08c5-41bb-baab-bb5cd2619d20", "content": "", "creation_timestamp": "2026-09-02T18:00:01.896252Z"}, {"uuid": "935bc23c-4e5c-4885-9f23-bf638710052a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59822", "type": "seen", "source": "https://bsky.app/profile/cvesentinel.bsky.social/post/3mukjswiki426", "content": "\ud83d\uded1 CVE-2026-59822\nBerriAI LiteLLM\nCVSS 8.8 / EPSS 1% / KEV \u2705\nTL;DR: LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior t\u2026\nhttps://cvesentinel.com/report/CVE-2026-59822?utm_source=bluesky&utm_medium=social&utm_campaign=cvesentinel\n#infosec #CVE #vulnerability", "creation_timestamp": "2026-09-02T18:10:04.677043Z"}, {"uuid": "7271ab1d-5e5c-45e4-8178-fab3f2207a12", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59822", "type": "seen", "source": "https://infosec.exchange/users/AAKL/statuses/117202988713449046", "content": "Looks like CISA's on a roll. Seven vulnerabilities have been added to the catalogue.\n- CVE-2026-83549: SonicWall SMA1000 Appliances OS Command Injection Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-83549\n- CVE-2026-83548: SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-83548\n- CVE-2026-9586: Sangoma Switchvox SQL Injection Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-9586\n- CVE-2026-82329: JFrog Artifactory Improper Authentication Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-82329\n- CVE-2026-49869: Kestra OSS OS Command Injection Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-49869\n- CVE-2026-48710: Kludex Starlette HTTP Request/Response Smuggling Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-48710\n- CVE-2026-59822: BerriAI LiteLLM Improper Authentication Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-59822 #CISA #infosec #vulnerability", "creation_timestamp": "2026-09-02T19:01:24.697392Z"}, {"uuid": "eb700761-8146-4c5c-ac39-f66ce025ef60", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59822", "type": "seen", "source": "https://bsky.app/profile/threatspotai.bsky.social/post/3mult7nlvhp2q", "content": "\ud83d\udea8 CISA KEV Alert\nCVE-2026-59822: \u26a0\ufe0f CVE-2026-59822: New Actively Exploited Vulnerability Added to CISA KEV\nSeverity: HIGH | CVSS: 0.0 | EPSS: 0.5%\nActively exploited\n\nRead the full alert: https://threatspot.ai/alerts/2026-59822-litellm-is-a-proxy-server-ai", "creation_timestamp": "2026-09-03T06:30:55.329886Z"}, {"uuid": "7a4b3322-7cfc-4c7d-8027-7d086affe9da", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59822", "type": "seen", "source": "https://bsky.app/profile/thecybermind.co/post/3mulxswen632c", "content": "Mitigate CVE-2026-59822 in BerriAI LiteLLM. Unauthenticated attackers bypass token checks on MCP endpoints. Read our T-Suite brief for Splunk, Sentinel, and Chronicle detection rules, plus vital hardening controls to lock down your AI infrastructure today. https://thecybermind.co/5vrg", "creation_timestamp": "2026-09-03T07:53:17.883352Z"}, {"uuid": "a9623afe-3417-4b6a-951c-4f85835a3696", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59822", "type": "seen", "source": "https://bsky.app/profile/forsmile.jp/post/3mumf3mrbwc2x", "content": "\u3010\u7dca\u6025\u3011LiteLLM \u306b\u6df1\u523b\u306a\u8106\u5f31\u6027\uff08CVE-2026-59822 / CVSS v3.1 \u3067 8.2 HIGH\uff09\n\n\u672a\u8a8d\u8a3c\u306e\u653b\u6483\u8005\u304c\u507d\u306eAuthorization\u30d8\u30c3\u30c0\u3067\u8a8d\u8a3c\u3092\u56de\u907f\u3057\u3001MCP\u30c4\u30fc\u30eb\u306b\u5230\u9054\u3067\u304d\u307e\u3059\u3002CISA\u304c9\u67082\u65e5\u306b\u60aa\u7528\u78ba\u8a8d\u6e08\u307f\u30ea\u30b9\u30c8\uff08KEV\uff09\u3078\u8ffd\u52a0\u3057\u307e\u3057\u305f\u3002\n\u5bfe\u51e6: LiteLLM\u30921.84.0\u4ee5\u964d\u3078\u3002Starlette\uff08CVE-2026-48710\uff09\u30821.0.1\u4ee5\u964d\u3078\u66f4\u65b0\u3092\u3002\n\nforsmile.jp/articles/lit...\n#\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3 #CVE", "creation_timestamp": "2026-09-03T11:50:49.305128Z"}, {"uuid": "d0b21faf-943d-4224-b618-ddc3609ea276", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59822", "type": "seen", "source": "https://bsky.app/profile/thecybermind.co/post/3mumqsof7mr2s", "content": "(CISA CS-MAN) The Cyber Mind CSUITE Brief: CVE-2026-59822 \u2013 BerriAI LiteLLM Improper Authentication\u00a0Vulnerability\n\nBerriAI LiteLLM is impacted by CVE-2026-59822, enabling unauthenticated attackers to bypass token validation. Review detection queries, compensating\u2026\n\nhttps://thecybermind.co/ng9r", "creation_timestamp": "2026-09-03T15:20:32.204530Z"}, {"uuid": "62852fee-dcfd-47f3-b579-352c769f3fe0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59822", "type": "seen", "source": "Telegram/1Sqk7SiaOozsfKPKNBJ8D4wLm4oiagj85GLZSROTXIrOhqI", "content": "", "creation_timestamp": "2026-09-03T17:00:05.962704Z"}, {"uuid": "e8b1bb30-3a51-4d18-849d-87add5597c54", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59822", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/1cb21f7a-02be-413e-88ea-fb6775aeabde", "content": "", "creation_timestamp": "2026-09-03T18:00:30.066356Z"}, {"uuid": "4cc7b918-1013-4203-bfef-3fb91a0e1cc9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59822", "type": "seen", "source": "Telegram/1Sqk7SiaOozsfKPKNBJ8D4wLm4oiagj85GLZSROTXIrOhqI", "content": "", "creation_timestamp": "2026-09-04T00:00:42.651702Z"}, {"uuid": "fd2821fc-93b8-4659-9568-a7c30f1bb9c4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59822", "type": "seen", "source": "https://bsky.app/profile/mel-echosphere.bsky.social/post/3muokph55rg26", "content": "\u300c\u8a8d\u8a3c\u306b\u5931\u6557\u3057\u305f\u300d\u306e\u306b\u3001\u7a7a\u306e\u6a29\u9650\u30aa\u30d6\u30b8\u30a7\u30af\u30c8\u304c\u6b8b\u308b\u3002\u5931\u6557\u304c\u901a\u884c\u8a3c\u306b\u306a\u308b\u8a2d\u8a08\u3060\u3002\ud83d\udc8e\n\nLiteLLM\u3001CVE-2026-59822\u3002MCP Streamable HTTP\u3067\u507dBearer\u3092\u6295\u3052\u308b\u3068\u3001\u30ad\u30fc\u691c\u8a3c\u5931\u6557\u2192OAuth2\u30d1\u30b9\u30b9\u30eb\u30fcfallback\u3078\u843d\u3061\u3066\u3001\u7a7a\u306eUserAPIKeyAuth()\u304c\u6b8b\u308b\u3002\u672a\u8a8d\u8a3c\u3067MCP\u30c4\u30fc\u30eb\u306b\u5c4a\u304f\u3002\u4fee\u6b63\u306f1.84.0\u3002\nhttps://github.com/advisories/GHSA-7488-6r32-c95q\n#LiteLLM #MCP", "creation_timestamp": "2026-09-04T08:36:40.843027Z"}, {"uuid": "caaec196-d798-4e61-8f4c-8d7b2cdfb170", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59822", "type": "seen", "source": "https://bsky.app/profile/mel-echosphere.bsky.social/post/3muokphuhw422", "content": "\u3084\u308b\u3053\u3068\u306f\u5358\u7d14\u3060\u30021.84.0\u4ee5\u4e0a\u3078\u4e0a\u3052\u308d\u3002\u3059\u3050\u7121\u7406\u306a\u3089 /mcp/ \u3092\u5916\u304b\u3089\u5207\u308c\u3002\u30b2\u30fc\u30c8\u30a6\u30a7\u30a4\u306b\u9375\u3092\u7a4d\u3080\u306a\u3089\u3001\u5931\u6557\u6642\u306e\u51fa\u53e3\u3082\u5883\u754c\u3060\u3002\n\n\u300c\u305f\u3076\u3093\u5927\u4e08\u592b\u300d\u3067\u6b8b\u3057\u305f\u7a7a\u30aa\u30d6\u30b8\u30a7\u30af\u30c8\u306f\u3001\u3044\u3064\u304b\u8ab0\u304b\u306e\u5165\u53e3\u306b\u306a\u308b\u3002 contr\u3002\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-59822\n#LLMSecurity #CVE", "creation_timestamp": "2026-09-04T08:36:41.805672Z"}, {"uuid": "d5094645-8163-4e21-a07e-76b8a657b66e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59822", "type": "seen", "source": "https://bsky.app/profile/suriq.io/post/3mutlawidqo2f", "content": "\ud83d\udd34 EXPLOITED\n\nLiteLLM, the open-source gateway fronting your LLM providers, has an auth bypass (CVE-2026-59822) CISA confirms is exploited.\n\nAttackers reach its MCP tools and steal the provider keys it stores.\n\nFix: update to 1.84.0 and rotate keys.", "creation_timestamp": "2026-09-06T08:29:46.700574Z"}, {"uuid": "c175f970-b3ab-485b-a23a-bc96c5e92034", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59822", "type": "seen", "source": "https://bsky.app/profile/arc-perimetered.bsky.social/post/3muz227agiq2k", "content": "CVE-2026-59822 isn't just a LiteLLM bug \u2014 it's a pattern.\n\nOAuth2 fallback logic in AI middleware means a malformed token doesn't fail closed. It fails open.\n\nYour proxy IS your perimeter. Auth bypass there = every model endpoint exposed, no lateral movement needed.", "creation_timestamp": "2026-09-08T12:37:44.764655Z"}, {"uuid": "5fd88ea0-55d2-4ba7-9573-615dfcbee08e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59822", "type": "seen", "source": "https://bsky.app/profile/sen-perimetered.bsky.social/post/3muz23fbh2c2y", "content": "CVE-2026-59822. LiteLLM. KEV'd Sep 2.\n\nFab a Bearer token \u2192 OAuth2 fallback fires \u2192 auth object is empty \u2192 MCP endpoints reachable unauthenticated. Wiz: honeypot hits confirmed.\n\nPatch trap: 1.83.0 fixed CVE-2026-35029. This one needs 1.84.0. One version gap, two different CVEs.", "creation_timestamp": "2026-09-08T12:38:25.171473Z"}, {"uuid": "18c5679f-eeea-425f-9266-2d149feaf3b7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59822", "type": "seen", "source": "https://bsky.app/profile/alien-rick.bsky.social/post/3mvl7esucs22p", "content": "*burp* LiteLLM sits between your apps and every model provider, and CVE-2026-59822 let a fake Bearer token walk straight through. CISA put it on the KEV list; federal patch deadline is today. Congrats Earth\u2014your AI bouncer waves in anyone who mumbles 'Bearer.' day259.002", "creation_timestamp": "2026-09-15T18:01:08.707229Z"}, {"uuid": "fff69a64-4359-4e5b-86bc-666d79ec4228", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59822", "type": "seen", "source": "https://www.acn.gov.it/portale/w/litellm-rilevato-sfruttamento-in-rete-della-cve-2026-59822", "content": "Rilevato lo sfruttamento in rete di una vulnerabilit\u00e0, identificata tramite la CVE-2026-59822, in LiteLLM di BerriAI, server proxy impiegato come gateway per l'accesso a modelli linguistici di grandi dimensioni (LLM). La vulnerabilit\u00e0 consente a un attaccante remoto non autenticato di eludere i meccanismi di autenticazione e accedere agli strumenti MCP senza disporre di credenziali valide.", "creation_timestamp": "2026-09-17T16:01:18.638069Z"}]}