The AI Gateway Becomes a Target: Measuring LiteLLM and Kestra Exposure

The CISA Known Exploited Vulnerabilities catalog update on September 2, 2026, marked a shift. Among the seven newly listed flaws were vulnerabilities in LiteLLM, an AI gateway, and Kestra, a workflow orchestration platform. For the first time, AI infrastructure components appeared as confirmed exploitation targets alongside traditional VPN and web-framework flaws. That makes their internet exposure worth measuring.

The problem and why it matters

LiteLLM (CVE-2026-59822, an improper authentication flaw rated CVSS 8.8) and Kestra (CVE-2026-49869, an OS command injection rated CVSS 10.0) are not edge appliances in the traditional sense. They are application-layer services that organizations deploy to route model requests and orchestrate data workflows. Because they often hold API keys to large language models and other sensitive services, a compromise can expose credentials rather than just compute.

Context and method

The counts below were collected with ZoomEye on 2026-09-19 using sub_type "all" and a page size of one, so each figure is the matched total. Query strings are included for reproducibility. These counts describe internet-facing assets matching a fingerprint, not confirmed vulnerable instances.

What the data shows

• app="LiteLLM" returned 34,412 matches, indicating a substantial number of internet-facing AI gateway deployments.
• app="Kestra" returned 126 matches, a much smaller footprint consistent with a more specialized orchestration tool.
• app="Langflow" returned 18,448 matches, another AI-adjacent platform with meaningful exposure.
• app="Metabase" returned 115,725 matches, a widely deployed analytics tool that has also appeared in exploitation reporting. The contrast between the AI-infrastructure counts is instructive. LiteLLM's larger footprint reflects how commonly AI gateways are deployed as shared services, often reachable by many internal clients and, in some cases, the internet. Kestra's smaller count does not make it less dangerous; a single exposed orchestration platform with command-execution potential is a serious risk.

Interpretation and practical value

AI infrastructure deserves the same exposure discipline as traditional services. These platforms frequently hold high-value secrets: model provider API keys, database credentials, and workflow tokens. When such a service is internet-reachable and unpatched, the consequence is not just service disruption but credential theft at scale.
The measurement supports a concrete workflow. An organization can query for its AI gateways and orchestration tools, compare the result to its inventory, and verify that none of them are exposed to the public internet. Any match that the organization did not expect is an immediate finding.

Implications and next steps

• Treat AI infrastructure as sensitive. Gateways and orchestration platforms hold credentials and should not be internet-facing.
• Patch KEV-listed AI components promptly. LiteLLM and Kestra are now confirmed exploitation targets.
• Rotate model provider keys if a gateway may have been exposed. Credential theft is the primary impact.
• Restrict access by identity. These services should authenticate every caller and log access.
• Include AI services in exposure monitoring. They are new, but they are not exempt from the same rules. The appearance of AI infrastructure on the KEV catalog is a signal that the attack surface has expanded. ZoomEye measurement makes that expansion visible and gives defenders a way to check whether their own AI services are part of it.

References

• ZoomEye queries executed 2026-09-19 (sub_type=all, pagesize=1): app="LiteLLM"; app="Kestra"; app="Langflow"; app="Metabase".
• CISA Known Exploited Vulnerabilities Catalog additions, 2026-09-02 (CVE-2026-59822 LiteLLM, CVE-2026-49869 Kestra).
• NVD entries for CVE-2026-59822 and CVE-2026-49869.