When AI infrastructure becomes the target: Securing gateways and control points | Microsoft Security Blog

What it is

A Microsoft Security investigation into three intrusions against AI infrastructure "control points": a LiteLLM gateway, a RAGFlow deployment, and a Kestra workflow environment. The detailed case is the LiteLLM gateway, compromised via CVE-2026-42271 (authenticated command execution in LiteLLM's MCP stdio test endpoints) chained with CVE-2026-48710 (a Starlette host-header validation bypass) to reach unauthenticated RCE. The other two workloads are named but not detailed in the fetched text.

How it works

CVE-2026-42271 supplies command execution through the MCP stdio test path; CVE-2026-48710 weakens the authentication boundary in affected configurations, making that execution reachable without valid credentials. Execution originates in the gateway process itself, not an unrelated system process. In containerized deployments where the gateway runs as PID 1, /proc/1/environ exposes the gateway's environment block. The payload read that file, filtered for keywords (master, API key, token, password, and UI fields), and exfiltrated model-provider keys, the LiteLLM master key, DB connection strings, and UI credentials.

Two behaviors the summary understates: exfiltration and payload retrieval were both redundant. Exfil cycled through Python urllib, curl, and wget as fallbacks against egress controls. Payload delivery used two paths — an inline Python command that fetched a masqueraded ELF (service-style naming/args posing as a Linux daemon), and a shell-stage downloader using multiple download methods with short timeouts and randomized temp paths. Host discovery then ran a silent passwordless-sudo check, listening-port inspection, and process sweeps for competing miners and remote-access tools, before XMRig cryptomining deployment.

Preconditions / Affected

• An exposed LiteLLM gateway running a version vulnerable to CVE-2026-42271, in a configuration where CVE-2026-48710 can bypass host-header validation.
• Containerized gateway running as PID 1, so provider keys and the master key live in the process environment reachable via /proc/1/environ.
• Applies by analogy to any AI control plane (RAGFlow, Kestra) that concentrates model keys, virtual keys, DB strings, tenant config, or execution privilege.

What to do

The page gives guidance rather than commands:

• Inventory exposed AI management surfaces; restrict administrative access to gateways/orchestrators.
• Monitor for gateway-originated process execution — the gateway process spawning shells, python -c, curl/wget, or ELF binaries is the key signal.
• Alert on reads of /proc/1/environ and secret-access patterns from the gateway runtime.
• Patch LiteLLM for CVE-2026-42271 and update Starlette for CVE-2026-48710 to break the unauthenticated-RCE chain.

Caveats

Microsoft assesses initial access "with high confidence" as likely through the exposed gateway surface and references the CVE chain via public research — it is attribution of the entry path, not confirmed exploitation of each specific CVE in every case. The fetched text also cuts off mid-Stage 4, so cryptomining/persistence details beyond XMRig staging are incomplete here.