Affected Systems

AI infrastructure platforms: LiteLLM gateways (CVE-2026-42271, CVE-2026-48710), RAGFlow deployments, and Kestra workflow environments. All exposed instances with administrative surfaces reachable from the internet are at risk. Affects organizations deploying AI gateways, retrieval-augmented generation platforms, and orchestration services.

Exploitation Status

Active exploitation confirmed. Microsoft Threat Intelligence observed intrusions across three distinct AI workloads. Public vulnerability chains exist for LiteLLM (CVE-2026-42271 + CVE-2026-48710 enabling unauthenticated RCE) and Kestra (CVE-2026-49869). RAGFlow exploitation path not attributed to specific CVE but consistent with SSRF-style reconnaissance and code execution.

Business Impact

Attackers gain access to model-provider API keys, LiteLLM master keys, database connection strings, tenant configuration data, and workflow execution privileges. Compromised AI gateways function as control planes enabling credential theft, persistent host access, downstream data exfiltration, and cryptomining. Organizations face unauthorized cloud API consumption, data exposure through stolen credentials, and resource exhaustion from cryptomining. AI infrastructure now represents a high-value target concentrating trust across users, applications, data, and models.

Urgency

🔴 Immediate

Recommended Actions

  • Inventory all exposed AI management surfaces (LiteLLM, RAGFlow, Kestra) and remove internet accessibility for administrative interfaces; enforce VPN or bastion access only
  • Patch LiteLLM instances immediately to address CVE-2026-42271 (MCP stdio command execution) and CVE-2026-48710 (Starlette host-header bypass); patch Kestra for CVE-2026-49869
  • Monitor gateway and orchestration service process trees for unexpected shell execution, Python droppers, and child processes spawning from AI service PIDs
  • Audit /proc/1/environ access, PostgreSQL connection attempts, and secret retrieval from AI gateway contexts; alert on credential harvesting patterns (grep for 'master', 'API_KEY', 'token', 'password')
  • Rotate all model-provider API keys, LiteLLM master keys, database credentials, and virtual keys for any AI infrastructure exposed prior to patching; review cloud billing for unauthorized API usage and cryptomining indicators (XMRig, high CPU)