CISA has added LiteLLM to its Known Exploited Vulnerabilities catalog, and it is not travelling alone: three of the seven flaws added on 2 September 2026 target AI infrastructure directly. The message for anyone running an LLM gateway in production is blunt. The AI stack is no longer a research toy attackers ignore; it is a mainstream target with confirmed in-the-wild exploitation.
What CVE-2026-59822 actually does
The newly listed flaw, CVE-2026-59822 (CVSS 8.8), lets an attacker open unauthenticated Model Context Protocol sessions using an arbitrary Bearer token. Every LiteLLM release before 1.84.0 is affected. In plain terms: the front door that is supposed to check who you are accepts a token it never validates, so an outsider talks to the gateway as if authorised.
This lands on top of an earlier chain that CISA flagged in June, command injection CVE-2026-42271 combined with the Starlette ‘BadHost’ issue CVE-2026-48710, which together reach unauthenticated remote code execution at CVSS 10.0. Operators associated with the Qilin ransomware crew have already used that path to drop an XMRig miner as an ELF binary. The gateway is being monetised the moment it is reached.
Why an AI gateway is worse than one more app
LiteLLM sits in front of dozens of models and is the routing layer many agent frameworks depend on. Compromise it and you do not get one server, you get the control plane: model API keys, provider credentials, request and response traffic, and the ability to steer what every downstream agent sees. That concentration is exactly what makes it attractive, and exactly why we test it as critical infrastructure in an LLM application penetration test and validate the MCP layer with MCP server security testing.
What to do this week
- Upgrade LiteLLM to 1.84.0 or later now, and take any gateway off the public internet. It belongs behind auth and a VPN, not on an open port.
- Rotate every secret the gateway held: model API keys, provider tokens, database credentials. Assume they are gone.
- Hunt for the known post-exploitation markers: rogue MCP sessions, unexpected ELF processes, and CPU spikes from mining.
- Treat the gateway as an exposed asset in your API penetration testing scope, and audit how it was pulled in with an AI supply-chain security audit.
- Put a runtime boundary around agent traffic so a compromised gateway cannot execute freely, the job our Airlock runtime firewall is built for.
The takeaway
Three of seven KEV additions hitting AI infrastructure is not noise, it is a trend line. LLM gateways carry the keys to your entire model estate, and they now attract the same operators who run ransomware campaigns. Patch LiteLLM, get it off the perimeter, and test it like the production infrastructure it has become.