AI Infrastructure Is Being Hacked for Keys, Shells and Crypto Mining

• The Mess: Attackers are actively targeting AI infrastructure, with exploited flaws in LiteLLM, Kestra and Starlette providing paths to authentication bypass, command execution, credential theft and persistent access. CISA has now added all three vulnerabilities to its Known Exploited Vulnerabilities catalog.
• The Damage: Compromising an AI gateway or orchestration platform can expose model-provider API keys, databases, cloud credentials and enough compute power to turn the victim’s infrastructure into an attacker’s mining rig.
• The Fix: Patch LiteLLM, Kestra and Starlette immediately, remove unnecessary internet exposure, lock down administrative interfaces and hunt for stolen credentials, unexpected workflows, SSH persistence and unauthorized compute activity.

AI infrastructure has officially become an attack surface worth stealing.

Not because attackers suddenly care about chatbots.

They care about everything sitting behind them.

Microsoft and Wiz have documented attacks against AI workloads where compromised systems were used to harvest secrets, access PostgreSQL databases, establish persistence, execute commands and deploy cryptocurrency miners. CISA has now added three vulnerabilities connected to this activity to its KEV catalog.

The first problem is LiteLLM.

CVE-2026-59822 affects the Model Context Protocol Streamable HTTP endpoint in LiteLLM. Before version 1.84.0, an unauthenticated attacker could abuse the authentication flow with a fabricated Bearer token and reach MCP tooling without possessing a valid LiteLLM key. The vulnerability carries a CVSS 4.0 score of 8.8 and was added to CISA KEV on September 2.

That is particularly nasty for an AI gateway.

LiteLLM can sit between applications and multiple model providers. Its environment may therefore contain provider credentials, model configuration, proxy-issued keys and database connection information.

Microsoft observed attackers abusing compromised LiteLLM deployments to harvest runtime secrets and PostgreSQL data. The attackers also deployed XMRig miners and modified SSH authorized keys to maintain persistence.

Then there is Kestra.

CVE-2026-49869 carries a maximum CVSS 10.0 rating.

The vulnerability is an authentication bypass caused by an overly broad path check. An attacker can abuse a path ending in /configs to bypass authentication and create or execute workflows without credentials. Because Kestra workflows can execute scripts, the result can become unauthenticated remote code execution.

And attackers apparently did not waste much time figuring out what to do after getting in.

Microsoft observed a Kestra intrusion involving shell execution, Docker environment discovery, cryptocurrency-mining deployment and additional data collection.

The third piece is Starlette.

CVE-2026-48710 is an HTTP request/response smuggling vulnerability that can allow attackers to manipulate the reconstructed URL path. If an application relies on that path for authentication decisions, the result can be an authentication bypass.

The vulnerability is rated CVSS 6.5 and was added to CISA KEV on September 2. CISA also notes that it can be chained with CVE-2026-42271.

That chain has already been associated with attacks against LiteLLM.

According to Microsoft, attackers used the LiteLLM/Starlette vulnerability chain to compromise exposed AI gateways, fingerprint the host, terminate competing mining processes and deploy an XMRig miner. The attackers also targeted LiteLLM database tables containing model configuration, provider endpoints and virtual keys.

This changes the way AI infrastructure needs to be viewed.

A vulnerable AI gateway is not just another web application.

It can become a credential concentrator.

A workflow engine is not just automation software.

It can become a remote command execution platform.

An MCP server is not just another interface for an AI model.

It can become a control point into tools and backend systems.

That is why the current attacks are interesting. The attackers are not necessarily trying to manipulate the model itself. They are going after the infrastructure surrounding it.

The payoff is much better.

Steal the provider keys and you can potentially access someone else’s AI account.

Steal the database and you may obtain configuration and authentication material.

Compromise the workflow engine and you get command execution.

Find exposed Docker access and the blast radius can increase again.

Then deploy a miner and monetize the compromised compute.

CISA’s September 2 KEV update lists CVE-2026-48710, CVE-2026-49869 and CVE-2026-59822 alongside four other actively exploited vulnerabilities. Federal civilian agencies are expected to address the Starlette and LiteLLM flaws by September 16, while the Kestra deadline is September 5.

For organizations running AI workloads, the message is uncomfortable but simple:

Inventory the AI stack.

Do not stop at the application that calls the model.

Find the gateways.

Find MCP endpoints.

Find workflow engines.

Find databases.

Find Docker sockets.

Find API keys.

Find anything exposed to the internet.

Then assume that a forgotten AI management interface will eventually be found by somebody else.

Bugstoday’s take: The interesting part is not that attackers discovered another three CVEs. It is what happens after exploitation. AI infrastructure is turning into a convenient combination of credentials, automation, privileged workflows and expensive compute. That makes it an unusually attractive target. If your AI stack is internet-facing, treating it like harmless developer tooling is already a bad security decision.

Today’s Bugs. Tomorrow’s Breaches.

Technical Sources

• CISA Known Exploited Vulnerabilities Catalog
• Microsoft Security — When AI infrastructure becomes the target: Securing gateways and control points
• CISA — September 2, 2026 KEV update
• CVE-2026-59822 — LiteLLM
• CVE-2026-49869 — Kestra OSS
• CVE-2026-48710 — Kludex Starlette
• Wiz — AI infrastructure honeypot research