CISA just put your AI stack in the same catalog as your firewalls
Not a lab any more. Production — and under active exploitation.
September 2, 2026: seven vulnerabilities added to the Known Exploited Vulnerabilities catalog. Two of them sit in the AI and DevOps toolchain. Remediation deadlines: September 5 and September 16.
WHAT ACTUALLY HAPPENED
CVE-2026-49869 — CVSS 10.0 — unauthenticated OS command injection in Kestra OSS, through workflow execution. Microsoft observed the full chain: shell execution via the workflow engine, Docker environment discovery, XMRig cryptominer deployment, data harvesting, and persistence written into ~/.ssh/authorized_keys.
CVE-2026-59822 — CVSS 8.8 — improper authentication in BerriAI LiteLLM's MCP endpoint, which accepts arbitrary Bearer tokens. Chained with CVE-2026-42271 to bypass authentication, drop ELF-based miners, and query PostgreSQL tables holding model configuration, upstream provider keys and proxy-issued virtual keys.
Alongside them: JFrog Artifactory (CVE-2026-82329, CVSS 9.8), improper authentication in default configuration, with actors minting admin tokens; Starlette (CVE-2026-48710) request smuggling for auth bypass, linked to Qilin; Sangoma Switchvox SQL injection driving reverse shells; and two SonicWall SMA1000 zero-days.
WHY THE AI LAYER IS THE SOFT TARGET
LiteLLM, Flowise, LangChain, Langflow, ChromaDB, Ollama, Marimo, MCP servers — this stack was deployed at experiment speed, by data teams, often outside the change process that governs everything else.
Look at what the LiteLLM attack actually took: not model weights, but upstream provider keys. Your gateway is a credential vault that nobody classified as one. Compromise it and the attacker bills inference to your account, reads every prompt that transits it, and pivots into the databases behind it.
The same logic applies to Kestra and Artifactory. Orchestrators execute arbitrary commands by design. Artifact repositories define what your build trusts. Both were meant to be internal. Both are routinely reachable.
Cryptomining is what you see. Key theft is what should worry you.
WHAT TO DO NOW
FIND YOUR SHADOW AI INFRASTRUCTURE — scan for these services before you patch them, because most estates do not know what is running.
TREAT AI GATEWAYS AS SECRET STORES — rotate provider keys now, scope them tightly, and alert on unusual inference volume.
GET THE ORCHESTRATORS OFF THE PERIMETER — Kestra and Artifactory belong behind authentication and network policy, never internet-facing.
ADOPT THE FEDERAL DEADLINES — September 5 for five of these CVEs is a reasonable bar for anyone, not just FCEB agencies.
Your AI pipeline inherited production privileges without inheriting production controls.
Does your CMDB list a single AI component today?