What landed in CVE-land this week

The week ending 5 September 2026 gave defenders a concrete answer to a question circulating since MCP shipped: what happens when an authentication layer trusts a token but never validates it? CISA's Known Exploited Vulnerabilities catalog added ten entries this week, spanning browser engines, PBX gear, SSL VPN appliances, artifact repositories, workflow engines, print servers, and AI infrastructure. This post covers two: the LiteLLM MCP session bug that lets any Bearer token establish an authenticated session, and the PaperCut chain that turns a missing auth check into JVM bytecode execution.

Lead: CVE-2026-59822, LiteLLM's MCP Streamable HTTP accepts any Bearer

CVE-2026-59822 was added to KEV on 2 September 2026. The catalog entry describes an improper authentication vulnerability in BerriAI LiteLLM's MCP Streamable HTTP endpoint: an unauthenticated attacker can establish an authenticated MCP session with any arbitrary Bearer token. This is not a bypass of some obscure header, not a race on session upgrade, not a signature confusion trick. The endpoint accepts any Bearer string and returns an authenticated session.

LiteLLM is a common proxy for organisations that route OpenAI-compatible requests across heterogeneous upstream models. The MCP Streamable HTTP transport was added so that LiteLLM could act as an MCP host: agent frameworks connect over HTTP, negotiate a session, and invoke tools LiteLLM proxies to downstream MCP servers. In many deployments the same LiteLLM instance holds credentials for internal search, ticketing, code repositories, and email. An "authenticated MCP session" therefore inherits whatever tools the platform team wired up.

Exploitation is straightforward. An attacker who can reach the MCP endpoint sends the initial handshake with any Bearer header, receives an authenticated session, and can enumerate tools, list resources, and invoke whatever the server exposes. The detection signal is not the token content but the pattern: sessions from source addresses that have not previously reached the endpoint, and Bearer values absent from the issued-key set.

To triage exposure, three questions cover most environments:

# 1. Is the MCP Streamable HTTP transport enabled?
curl -sS -o /dev/null -w '%{http_code}\n' \
  -H 'Accept: application/json, text/event-stream' \
  https://litellm.example.com/mcp/

# 2. Does a garbage Bearer still get a session?
curl -sS -H "Authorization: Bearer not-a-real-token-$(uuidgen)" \
     -H 'Content-Type: application/json' \
     -H 'Accept: application/json, text/event-stream' \
     -d '{"jsonrpc":"2.0","id":1,"method":"initialize",
          "params":{"protocolVersion":"2025-06-18",
                    "capabilities":{},
                    "clientInfo":{"name":"probe","version":"0.0"}}}' \
     https://litellm.example.com/mcp/

# 3. If step 2 returns a session id, list the tools it exposes:
#    repeat with method "tools/list" using the returned session identifier

If the initialize call returns a session identifier and capabilities block for a request bearing a random token, the instance is vulnerable and reachable. A WAF provides no protection here: the request is well-formed JSON-RPC over HTTP, and no signature-based rule will flag it.

Compensating controls, ranked by risk reduction: place the MCP endpoint behind mTLS or an authenticating reverse proxy that validates tokens before LiteLLM sees the request; disable the MCP transport on instances that do not need it (many were enabled for testing and never turned off); and rotate any downstream credentials the MCP server proxies, on the assumption that a session may already have been used to enumerate tool schemas even without an explicit tool call. Patch to the fixed release, then verify with the same three curl calls above, from outside the trust boundary.

MCP session establishment in several implementations conflates "the client presented a Bearer" with "the Bearer is valid." Any MCP host deployment warrants the same audit: log the first ten bytes of every accepted Bearer token, compare against issued tokens, and alert on any mismatch. That check would have surfaced this behaviour on day one.

Secondary: CVE-2026-82078 chained with CVE-2026-81578 in PaperCut NG/MF

The PaperCut pair landed in KEV on 31 August 2026. CVE-2026-81578 is a missing-authentication-for-critical-function vulnerability: an unauthenticated remote attacker can modify system configurations. CVE-2026-82078 is an unsafe reflection vulnerability that lets an attacker set configuration parameters to target classpath-resident gadget classes, executing arbitrary Java bytecode under the PaperCut server process's security context. The catalog notes that the two chain.

The chain: call the unauthenticated configuration endpoint (CVE-2026-81578), set the reflection sink parameters to target a gadget class already on the classpath (CVE-2026-82078), and trigger execution. Because the reflection sink resolves classes that ship with the product or the JVM runtime, no payload smuggling is required; the attacker names an existing class. Detection signals include configuration writes from unexpected source addresses, a child process spawned from the PaperCut JVM, or a burst of outbound DNS from the server.

Two operational notes. First, PaperCut deployments often sit on print segments considered "internal enough" to skip regular security scrutiny. If your asset inventory omits print servers, you cannot assess exposure. Second, patching alone is insufficient. Unauthenticated configuration writes may already have occurred; audit the configuration store for any parameter values referencing class names, method names, or fully qualified Java identifiers outside the product's own schema.

Housekeeping and the rest of the week

The remaining KEV additions this week (Chromium V8 type confusion CVE-2026-85046, Sangoma Switchvox SQL injection CVE-2026-9586, SonicWall SMA1000 CVE-2026-83548 and CVE-2026-83549, JFrog Artifactory CVE-2026-82329, Kestra OSS CVE-2026-49869, and Starlette request smuggling CVE-2026-48710) will each receive dedicated coverage. Cisco published a bundle of advisories today, including critical remote code execution on Nexus 9000 Silicon One (CVE-2026-20212) and a static credentials bug in Secure Firewall Management Center (CVE-2026-20316); neither is on KEV yet, but both warrant prioritisation.

One pattern repeats across this week's disclosures: authentication that trusts what the client asserts rather than what the server verifies. Test for it.

Verifiable security.