A Ransomware Crew Found the Weak Seam Between Two Open-Source Projects
LiteLLM is the connective tissue a lot of enterprises now run between their applications and the half-dozen model providers behind their AI features. It is open source, built by BerriAI, and popular precisely because it lets a platform team swap GPT, Claude, or Gemini behind one internal API without rewriting application code. That popularity is exactly why CISA's September 3 update to its Known Exploited Vulnerabilities catalog deserves a read past the CVE numbers. It confirms a ransomware group is now using LiteLLM as a way into corporate networks, not just a convenience layer for routing model calls, and it is the clearest sign yet that AI gateways have become a genuine ransomware entry point rather than a theoretical one.
The mechanism is a two-step bypass. CVE-2026-48710 is a host header authentication bypass in Starlette, the ASGI framework LiteLLM is built on, in any version at or below 1.0.0. CVE-2026-42271 is a command injection flaw in LiteLLM's own MCP test endpoints, which normally require an API key to reach. Chain the two and an attacker gets remote code execution on the gateway host without ever authenticating. CISA's advisory states plainly that threat actors associated with the Qilin ransomware group, also tracked as Agenda, have been linked to active exploitation of this exact chain.
Two Different Attackers, One Open Door
What makes this a genuinely enterprise-relevant story rather than another niche CVE is that two unrelated attack campaigns found the same door independently. Microsoft's own telemetry, cited in the same disclosure, shows a separate set of actors using the identical CVE-2026-42271 and CVE-2026-48710 chain to deliver an XMRig cryptocurrency miner through an ELF binary. Before dropping the miner, the intruders fingerprinted the host and killed any competing mining processes already running, standard tradecraft for crews that expect to be sharing infrastructure with rivals who found the same opening.
Two campaigns with different objectives, ransomware access on one side and resource monetization on the other, converging on the same unauthenticated RCE chain tells you the exploit is reliable and the exposed population is large enough to sustain two separate criminal business models at once. CISA's catalog listing also carries a federal patching deadline, which is as close as the agency gets to saying this is being actively weaponized against real production systems right now, not a research finding sitting on a shelf waiting for a proof of concept to go public.
A Second, Unrelated Flaw Landed in the Same Batch
The same September 3 KEV update added a third vulnerability to the pile, CVE-2026-59822, an improper authentication bug in LiteLLM's Model Context Protocol Streamable HTTP endpoint. It lets an unauthenticated attacker establish a valid MCP session using an arbitrary bearer token, a distinct bug from the Starlette-chained RCE that requires its own patch entirely. Any team that fixes CVE-2026-42271 and CVE-2026-48710 and calls the gateway secure has left a second, unrelated front door open on the same product, discovered and disclosed independently of the ransomware-linked chain.
This is the pattern enterprise security teams keep underestimating with AI infrastructure specifically. A gateway like LiteLLM sits in front of every model call your applications make, which usually means it has network reach to internal services, API keys for every provider you use, and often broader cloud credentials than anyone budgeted for when it was deployed as a routing convenience. Three separate authentication and injection flaws surfacing on the same product in one KEV batch signals that the AI gateway layer has not had the scrutiny your VPN concentrators and identity providers get after years of attacker attention.
Why the Gateway Layer Keeps Getting Skipped
Most platform teams stood up LiteLLM or something like it in the last two years, during a period when the priority was shipping AI features fast enough to keep pace with product roadmaps. Security review cycles that a database, a message queue, or an identity provider would automatically trigger often never happened for the AI gateway, because it was categorized internally as developer tooling rather than production infrastructure carrying live credentials and a public-facing attack surface.
That categorization gap is closing the hard way. A component that routes every AI call your organization makes, and typically holds the API keys and service credentials to do it, is functionally identical in risk profile to an API gateway or a secrets manager, and it deserves the same patching cadence, network segmentation, and access logging. The fact that it took a ransomware group and an unrelated cryptomining crew to force that recognition is the actual lesson enterprise security leaders should take from this disclosure.
What to Actually Do About It This Week
The fix for the ransomware-linked chain is to upgrade LiteLLM to version 1.83.7 or later and Starlette to 1.0.1 or later. For CVE-2026-59822, check BerriAI's advisory for the specific patched build, since it is a separate code path from the RCE chain. If upgrading immediately is not possible, block access to the vulnerable MCP test endpoints at your reverse proxy or API gateway and restrict network reach to the LiteLLM host to trusted internal segments only, since none of this requires internet exposure to matter once an attacker is already inside your perimeter.
Patching alone does not undo what already happened if you were running a vulnerable version with internet exposure. Assume any secret reachable from the LiteLLM environment, provider API keys, cloud IAM credentials, Kubernetes service account tokens, and any CI/CD tokens the gateway host could see, needs to be rotated. Review access and audit logs going back to when your instance was last patched, watch for unusual Host headers in your logs, the tell for the Starlette bypass, and check for unauthorized subprocess execution or unexpected outbound connections before you consider the incident closed.
