SURIQ
CISA's Known Exploited Vulnerabilities catalog spent years listing firewalls, VPN gateways, and mail servers. On September 2 it started listing something else: the software your AI stack is assembled from. Three of the seven flaws CISA added that day sit inside self-hosted AI and developer infrastructure, and all three are already being exploited. The hard part for defenders is not the patch. It is that you cannot inventory a Python library the way you inventory a SonicWall box, and the sharpest of the three is the one place your model provider keys all live.
That flaw is CVE-2026-59822 in LiteLLM, an open-source gateway that sits in front of your language-model providers and hands out access to them. It carries a high severity rating, CVSS 8.2 in the project's own advisory. The other two are Starlette (CVE-2026-48710, CVSS 6.5), the framework a large share of Python web services quietly runs on, and Kestra (CVE-2026-49869, CVSS 10.0), a workflow engine.
What CVE-2026-59822 hands an attacker
LiteLLM's flaw lives in its Model Context Protocol (MCP) endpoint. MCP is the protocol that lets AI agents call external tools. The gateway supported an OAuth2 passthrough for upstream MCP servers, and the fallback in that path had a bug: when validation of a LiteLLM key failed, it dropped back to an empty authentication object instead of rejecting the request. A caller who sends any made-up authorization header therefore reaches the MCP tooling without holding a real key. In plain terms, a stranger can log in to the tool endpoint with a token it invents.
The blast radius is what makes this worse than a typical gateway bug. An LLM gateway is a credential concentrator. It stores the API keys for every upstream provider you use and mints its own proxy virtual keys for the apps behind it. Break the front door and you inherit the whole key ring, plus whatever the connected MCP tools can touch: databases, cloud accounts, internal apps. According to reporting from The Hacker News, that is the pattern in the wild. Attackers chained their way past authentication, dropped XMRig cryptocurrency miners, reached the PostgreSQL backend, and pulled out stored provider key material and the proxy-issued virtual keys.
Why this is not a normal appliance CVE
A SonicWall or an Artifactory box shows up in an asset register. You know you own it, you know where it sits, and a scan finds it. The AI-stack additions do not behave that way, and that is the real story here.
Starlette is the ASGI foundation that FastAPI is built on, so most teams running it never installed it on purpose; it arrived as a dependency of something else. Its flaw lets an attacker inject a path into the host portion of a request, which slips past authorization checks that trust the reconstructed URL path. Kestra is a workflow engine whose flaw is an unauthenticated command injection scored a full 10.0. Microsoft documented likely exploitation as early as late June: a reverse shell, Docker environment discovery, defense evasion, a crypto miner, and data collection through the workflow tasks themselves. None of these is a device you rack. They are libraries and services woven into applications, which means the first defensive question, "do we even run this," is genuinely hard to answer.
The gateway is the IAM of your AI stack
It is worth naming what LiteLLM's role actually is, because it changes how you should prioritize this. The gateway is the identity and access layer for everything your models touch. Every app authenticates to it, every provider key lives behind it, and increasingly every agent tool is reachable through its MCP endpoint. Treat a compromise of it the way you would treat a compromise of your identity provider, not the way you would treat a single vulnerable web app.
MCP is the part to watch going forward. Its whole purpose is to give an agent reach into tools and data. An authentication bypass on the MCP endpoint converts that designed reach into an attacker's reach, and CVE-2026-59822 is one of the first MCP-protocol auth failures to land on CISA's actively-exploited list. We have written about MCP going wrong before, from a token leak in a Grafana MCP server to a container escape in Docker's MCP gateway. This is the same surface, now with confirmed exploitation behind it. It is also the second serious LiteLLM issue we have tracked this quarter, after the supply-chain incident that, according to that reporting, briefly compromised its releases in August.
Rotate the keys before you trust the patch
Kestra's federal deadline was September 5 and has already passed; LiteLLM and Starlette are due September 16. Meeting the deadline means patching to the fixed builds: LiteLLM 1.84.0, Starlette 1.0.1, Kestra 1.0.45 or 1.3.21. But patching only closes the door. It does not rotate the provider keys the gateway already stored, revoke the virtual keys it issued, or end a session an attacker opened with a forged token. For any LiteLLM instance that was reachable before you patched, treat the stored secrets as burned: rotate every upstream provider key, reissue the virtual keys, and hunt for what a pre-patch intruder may have left behind, from XMRig processes to workflow runs and MCP sessions nobody on your team started. This is the difference between closing the exposure and knowing whether it was already used, and only the second one tells you if you are clear.
pip show litellm # exposed if version < 1.84.0 pip show starlette # exposed if < 1.0.1 (FastAPI pulls this in transitively) docker image ls | grep kestra # exposed if below 1.0.45 or 1.3.21
The wider signal is the one to carry out of this. CISA's catalog is no longer just about the perimeter. The dependency layer of the AI stack is now a confirmed target, and the tools that make self-hosted AI convenient, a gateway that holds all your keys and a protocol that reaches all your tools, are exactly what an attacker wants most.
| Component | CVE | Flaw | CVSS | Fixed in | KEV deadline |
|---|---|---|---|---|---|
| LiteLLM (LLM gateway) | CVE-2026-59822 | MCP auth bypass | 8.2 | 1.84.0 | Sep 16, 2026 |
| Starlette (ASGI framework) | CVE-2026-48710 | Request smuggling | 6.5 | 1.0.1 | Sep 16, 2026 |
| Kestra (workflow engine) | CVE-2026-49869 | Unauth command injection | 10.0 | 1.0.45 / 1.3.21 | Sep 5, 2026 |