Vulnerabilities & Exploits

Microsoft Broadens AI Gateway Abuse to Three Workloads

On day 15, Microsoft said the LiteLLM activity has widened into a broader pattern across three AI workloads: LiteLLM, RAGFlow, and Kestra. The company said attackers are treating exposed AI gateways and workflow layers as control points for credential theft, persistence, and cryptomining, not just one-off product bugs.

The issue is the trust these services hold. Microsoft said they can sit on model-provider keys, virtual keys, database connection strings, tenant policy, and execution rights, so a foothold in the middle tier can be reused to reach the systems behind it; in LiteLLM’s case, the observed path includes CVE-2026-42271.

For teams running AI gateways, orchestration, or agent tooling, the exposure lives in the management layer and whatever it can already access. Patching the visible flaw does not erase secrets or downstream paths if the service was already acting as the bridge between users, models, and internal systems.

26 sources · Aug 28

CVE-2026-42271

NVD KEV

Known exploited · CISA KEV

CVSS 8.8 HIGH: liteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. EPSS 84% (100th percentile).

CISA federal remediation date Jun 22 · date passed

Timeline

Aug 28 Reported by BleepingComputer
Aug 28 Reported by Huntress Blog
Aug 27 Reported by Snyk Blog
Aug 25 Reported by SentinelOne
Aug 24 Reported by SecurityWeek
Aug 22 Reported by The Register Security
Aug 21 Reported by Schneier on Security
Aug 20 Reported by CyberScoop
Aug 19 Reported by Help Net Security
Aug 18 Reported by Mandiant
Aug 16 Reported by Socket.dev
Aug 14 Reported by Wiz Research
Aug 14 Reported by CSO Online
Aug 12 Reported by ESET Research
Aug 10 Reported by Cybersecurity Dive
Jun 22 CISA federal deadline for CVE-2026-42271 passed
Jun 8 CVE-2026-42271 added to CISA KEV

Sources

Aug 28 BleepingComputer
AI Is Accelerating Vulnerability Discovery. Can Defenders Keep Up?
AI is accelerating vulnerability discovery, putting pressure on systems built to enrich, prioritize, and remediate flaws at a slower pace.
original
Aug 28 Huntress Blog
The AI Attack Surface: How Threat Actors Abuse Trusted AI Platforms | Huntress
Threat actors are targeting the AI attack surface to deliver malware and steal data. See how trusted AI tools are being exploited today.
original
Aug 27 Risky Biz News
Srsly Risky Biz: China's AI-Enabled APT Operations Are Getting Interesting
Tom Uren and James Wilson talk about evidence that Chinese APT groups are using AI in a really sensible way, to beef up their malware arse [Read More
original

Part of the PlainSec briefing for 2026-08-20

Every edition of this story: Microsoft Broadens AI Gateway Abuse to Three Workloads

More from today

Vulnerabilities & ExploitsMicrosoft Broadens AI Gateway Abuse to Three WorkloadsOn day 15, Microsoft said the LiteLLM activity has widened into a broader pattern across three AI workloads: LiteLLM, RAGFlow, and Kestra. The company said attackers are treating exposed AI gateways and workflow layers as control points for credential theft, persistence, and cryptomining, not just one-off product bugs.The issue is the trust these services hold. Microsoft said they can sit on model-provider keys, virtual keys, database connection strings, tenant policy, and execution rights, so a foothold in the middle tier can be reused to reach the systems behind it; in LiteLLM’s case, the observed path includes CVE-2026-42271.For teams running AI gateways, orchestration, or agent tooling, the exposure lives in the management layer and whatever it can already access. Patching the visible flaw does not erase secrets or downstream paths if the service was already acting as the bridge between users, models, and internal systems.26 sources · Aug 28