CVE-2026-59822: Forged Bearer Token Bypasses LiteLLM MCP Auth

Arnold Chan@slaz

•updated Sep 12, 2026•0•0•3

This rule detects potential exploitation attempts (CVE-2026-59822) against LiteLLM MCP tool endpoints. It identifies HTTP requests where the authorization bearer token is unusually short (<= 12 chars), lacks the 'sk-' prefix, and does not appear to be a valid JWT, yet successfully results in a 200 OK status, indicating a potential bypass of authentication logic.