Attackers Are Hunting Your AI Gateway: Inside the LiteLLM / RAGFlow / Kestra Campaign

A coordinated campaign is treating AI infrastructure itself as the prize. In an analysis published on 26 August 2026, Microsoft detailed attackers systematically hunting exposed AI gateways and orchestration tools — LiteLLM, RAGFlow, Kestra — to steal the one thing that concentrates there: every model-provider API key an organisation owns. Then they turn the compromised box into a cryptominer.

What Microsoft observed

Per Microsoft's write-up, the campaign hit three kinds of AI infrastructure with a consistent objective — harvest credentials, persist, and monetise the compute:

• LiteLLM (AI gateway): initial access through the exposed gateway surface, chaining CVE-2026-42271 (an MCP command-execution flaw) with CVE-2026-48710 (a Starlette host-header bypass).
• RAGFlow (RAG / document processing): SSRF-style reconnaissance, then code execution, then a Python hook injected into the credential-configuration flow so it silently intercepts provider type, model name, endpoint and API key every time an admin sets up an LLM integration (template-injection flaws CVE-2026-45312, CVE-2026-28797).
• Kestra (workflow orchestration): CVE-2026-49869, a critical authentication bypass enabling unauthenticated workflow execution.

What they took is the point: model-provider API keys, LiteLLM master keys, virtual-key records, database connection strings, and cloud credentials — keys for OpenAI, Azure, Anthropic and Gemini pulled from container environment variables. Then came the payloads: XMRig / RandomX cryptominers with CPU tuning, SSH authorized_keys for persistence, and ELF binaries masqueraded as system daemons.

Why the gateway is the target

An AI gateway exists to put every model provider behind one door. That is its value — and exactly why it is worth breaking into. Compromise it and you get free inference on someone else's bill, access to whatever data those models can reach, and a pivot into the cloud account the keys belong to. This is the same lesson as the LiteLLM CVE on CISA's KEV list and the Langflow key-theft wave, now confirmed as a deliberate, multi-platform campaign: AI infrastructure is credential-harvesting infrastructure.

What to do now

• Get AI gateways off the public internet. LiteLLM, RAGFlow, Kestra, Flowise and friends should sit behind authentication and network controls, never exposed. Patch the named CVEs immediately.
• Assume key compromise if you were exposed. Rotate every model-provider key, master/virtual key, and any cloud credential that lived in those environments — and review provider and cloud billing for mining spend, which shows up before logs do.
• Find your exposed AI control points. Most teams cannot list them. The free AI Footprint Scanner maps what is reachable, and MCP Guard checks your MCP endpoints.
• Inventory the AI infra in your stack. The free AI Dependency Scanner flags LiteLLM, Langflow and other frameworks in your manifests so you can confirm each is patched, and the OWASP LLM checklist maps the failure modes.

Sources

• Microsoft Security — When AI infrastructure becomes the target (Aug 26, 2026)
• The Hacker News — CISA adds seven exploited flaws (LiteLLM, Kestra)