Attackers are tired of knocking on your front door. They are going after the tools that hold your keys: the AI gateway, the software repository, the workflow engine. On September 2, CISA added seven flaws to its Known Exploited Vulnerabilities list. Several sit in tools most security teams do not even track. Ask yourself: who owns your LiteLLM box? If you paused, keep reading.
What happened
Three very different tools, one pattern: unpatched, internet-facing, full of secrets.
| Tool | What it does | The flaw | What attackers did |
|---|---|---|---|
| JFrog Artifactory | Stores your software packages and build outputs | CVE-2026-82329 (auth bypass); CVE-2026-42018 + CVE-2026-42016 (chained) | Minted admin tokens, created rogue admins, planted Groovy plugins and custom Rust backdoors |
| LiteLLM | AI gateway that stores your model provider keys | CVE-2026-42271 (command injection) + Starlette CVE-2026-48710 (Host header bypass) | Unauthenticated code execution on the gateway host; access to stored provider credentials |
| Kestra | Workflow orchestration | CVE-2026-49869 (CVSS 10.0) | Reverse shell, Docker discovery, crypto miner |
The Artifactory timeline is the scary one. JFrog disclosed CVE-2026-82329 on August 28, but watchTowr researchers saw attackers using it before that. Separately, Wiz documented attacks on a second Artifactory flaw chain from August 15 to September 8.
One detail from Wiz: actions taken with the stolen tokens showed up in logs as “token:anonymous.” That is not a name your analyst will chase.
Why defenders miss it
A 6.5 and an 8.8 became a 10.0. The Starlette flaw scores 6.5 on its own. The LiteLLM flaw scores 8.8 and needed a valid API key. Chain them and the Host header bypass removes the login, so anyone can run commands on the gateway. Horizon3 rates the chain 10.0. If your patching queue sorts by CVSS alone, the Starlette bug sat near the bottom.
Patching does not fix the damage. Per BleepingComputer, upgrading Artifactory does not invalidate a token the attacker already minted. You can be fully patched and still owned.
These tools hold master keys. LiteLLM stores your model provider credentials. Artifactory feeds packages into your builds. Compromise either and the attacker does not need to hack your next system. Yours will hand it over.
Nobody owns them. This is my read, not a sourced fact: these tools usually get installed by a dev, data or AI team, not IT. They never make it into the asset inventory, so they never make it into the patch cycle.
The ransomware link is reported, not proven. The Hacker News says the LiteLLM chain is associated with Qilin ransomware. An earlier Hacker News report on the same flaw said the actors were unidentified. Treat the Qilin tie as a lead. It is a serious lead: Bitdefender counts 166 Qilin victims in August, out of about 1,000 claimed across 83 active groups that month.
Why it matters, and the legal angle
A compromised repository is not just your problem. If an attacker poisons a package you publish, your customers inherit the breach. That is where the contract claims and the disclosure questions start.
Three things a board will ask, and your lawyer will care about:
- Disclosure clock. For SEC-registered companies, Form 8-K Item 1.05 requires disclosure within four business days after the company determines a cyber incident is material. The clock runs from that determination, so a slow, foggy triage process is itself a risk.
- “Known and exploitable.” CISA’s KEV list binds federal agencies, not you. My view: it is becoming the yardstick for reasonable security. In a dispute, “the flaw was on the KEV list and we did not patch” is a bad fact.
- Stolen keys. If a provider key or customer data was in that gateway, breach notification and contract duties may follow. Find out what the tool stored before you find out from the attacker.
This is general information, not legal advice.
What a you should do this week
- Find every instance. Search for LiteLLM, Artifactory and Kestra, including dev and test servers. Ask the AI, data and platform teams directly. Your scanner will miss the shadow ones.
- Patch both layers. LiteLLM needs 1.83.7 or later and Starlette 1.0.1 or later. Artifactory has fixed releases on each branch (for example 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38, 7.161.20). Check that you are on yours.
- Rotate, do not just patch. Revoke and reissue all Artifactory tokens and admin accounts. Rotate every model provider key that ever lived in your gateway. Set spend caps on those keys.
- Hunt for the tells. Artifactory: admin actions logged as “token:anonymous”, new admin accounts, unfamiliar Groovy plugins, odd binaries in /tmp. LiteLLM: requests to /mcp-rest/test/ paths and strange Host headers. Kestra: outbound reverse shells, Docker enumeration, mining processes.
- Take the admin surface off the internet. Put these tools behind a VPN or allowlist. If you cannot patch today, block /mcp-rest/test/ at the proxy as a stopgap.
- Name an owner. One person per tool, in your asset inventory, with a patch SLA. If nobody will own it, retire it.
#cybersecurity #CISO #AIsecurity
