The Cybersecurity and Infrastructure Security Agency added seven vulnerabilities to its Known Exploited Vulnerabilities catalog on Sept. 2, 2026, based on evidence of active exploitation. Three of the seven affect artificial intelligence and machine learning infrastructure — the first KEV batch in which AI-related components make up nearly half the additions.
Authentication Bypass in a Widely Used AI Gateway
The most significant of the AI-related entries is CVE-2026-59822, an improper-authentication flaw in LiteLLM, an open-source proxy server that routes calls to large language model APIs. According to the National Vulnerability Database, versions of LiteLLM prior to 1.84.0 allowed an unauthenticated attacker to submit a fabricated bearer token to the product’s Model Context Protocol Streamable HTTP endpoint, triggering an OAuth2 fallback path that granted access without a valid key. The flaw is fixed in version 1.84.0 and carries a CVSS score of 8.8.
CISA also added CVE-2026-48710, an HTTP request/response smuggling vulnerability in the Starlette web framework that underlies the popular FastAPI toolkit used to build many AI agent and API services. Because Starlette typically ships as a transitive dependency of FastAPI rather than a direct one, researchers tracking the issue note it rarely appears in software inventories, making dependency lockfile scanning the more reliable way to detect exposure. A third AI-adjacent flaw affects JFrog Artifactory, a package repository manager widely used in AI development pipelines to store and distribute models and dependencies.
Agentic Infrastructure Becomes a Target
Security researchers at Microsoft and Wiz say the exploitation activity reflects a broader shift toward targeting AI infrastructure components — including LLM gateways, vector databases and MCP servers — to steal API keys, gain backend access, and monetize compromised hosts, in some cases through cryptocurrency mining.
Under Binding Operational Directive 26-04, federal civilian agencies must remediate most of the newly added vulnerabilities by Sept. 5, 2026, while the Starlette and LiteLLM flaws carry a Sept. 16, 2026 deadline. CISA continues to recommend that all organizations, not just federal agencies, prioritize patching KEV Catalog entries as part of routine vulnerability management.
Leave a Reply