Microsoft has been investigating live intrusions against exactly the stack a lot of us self-host: an LLM gateway (LiteLLM), a RAG platform (RAGFlow), and a workflow runner (Kestra). The findings are not subtle — attackers read container env vars, planted a hook that steals every API key an admin saves, and left Monero miners behind.
The nasty detail is the RAGFlow hook. It sat in the credential-configuration flow, so every time an administrator saved a provider setting, it silently captured the new API key. The normal remediation step — "rotate the key and paste in a new one" — hands the attacker the replacement.
The LiteLLM case: CVE-2026-42271 (command injection) chained with CVE-2026-48710 (Starlette host-header bypass) to reach unauthenticated RCE, then read /proc/1/environ for keys and database URLs.
On September 2, CISA added these flaws to its Known Exploited Vulnerabilities catalog. Federal agencies must patch LiteLLM and Starlette by September 16, 2026.
What to do: get admin surfaces off the public internet, rotate keys after confirming the host is clean, move secrets out of env vars, and alert on AI components spawning shells.
Full breakdown with the version numbers and the full persistence toolkit: https://cyberpicks.org/guides/ai-gateway-attacks-microsoft
Top comments (0)