Active in-the-wild exploitation campaign against LiteLLM, RAGFlow, and Kestra AI infrastructure gateways

Microsoft published a threat-intelligence report on Aug 26, 2026 describing three separate observed intrusions into AI infrastructure: a LiteLLM proxy gateway, a RAGFlow deployment, and a Kestra workflow environment. In each case attackers treated the AI control-plane component as a high-value target for credential theft, persistence, and compute monetization (cryptomining) rather than targeting the model itself.

This is a real, currently-active campaign (not a theoretical PoC) against the credential-concentrated middleware layer of the AI stack — gateways, RAG platforms, and orchestrators — that most security programs do not yet treat with the same rigor as core enterprise infrastructure, despite these components holding model-provider keys and downstream database/cloud access.

LiteLLM: authenticated command-execution in MCP stdio test endpoints (CVE-2026-42271) chained with a Starlette host-header validation bypass (CVE-2026-48710) to achieve unauthenticated RCE on exposed gateways; attackers then read /proc/1/environ for secrets and queried the backing PostgreSQL database. RAGFlow: SSRF-style recon followed by code execution and a persistence hook in the TenantLLM credential-configuration flow to intercept newly configured provider keys. Kestra: exploitation of exposed orchestration surface (CVE-2026-49869) enabling unauthenticated workflow creation/execution, shell execution, and XMRig deployment.

LiteLLM gateway (versions 1.74.2–1.83.6, fixed 1.83.7) chained with Starlette <1.0.1 (CVE-2026-48710); RAGFlow (multiple execution paths, not attributed to single CVE); Kestra (CVE-2026-49869)

Patch LiteLLM to >=1.83.7 and verify the deployed Starlette version is >=1.0.1; patch Kestra per vendor advisory; inventory and restrict administrative access to AI gateway/orchestration/RAG management surfaces; rotate all provider keys, master keys, virtual keys, and DB credentials if compromise is suspected; monitor for gateway-originated shell execution and secret access.