LiteLLM MCP endpoint scanning/exploitation attempt (CVE-2026-59822)

Arnold Chan@slaz

•updated Sep 12, 2026•0•0•3

Detects unauthorized exploitation attempts against the LiteLLM Model Context Protocol (MCP) endpoint. The rule monitors for a specific malformed Authorization header pattern (short, non-standard token) associated with CVE-2026-59822, indicating potential vulnerability scanning or exploitation of the service.