Microsoft Documents Live Attacks on LiteLLM, RAGFlow, and Kestra Control Planes

Internet-exposed LiteLLM gateways, RAGFlow retrieval platforms, and Kestra workflow orchestration deployments

Microsoft published observed intrusions against three classes of AI infrastructure, each ending in credential theft, persistence, and cryptomining. Against LiteLLM the chain ran from gateway exploitation to harvesting `/proc/1/environ` for provider API keys, then into the PostgreSQL backend for model configuration and virtual keys, then XMRig with RandomX CPU tuning and a service-account SSH key for persistence; the named flaws are CVE-2026-42271, authenticated command execution through MCP stdio endpoints, and CVE-2026-48710, a Starlette host-header validation bypass that makes the pair unauthenticated in exposed deployments. Against RAGFlow the actors used server-side request forgery style reconnaissance, injected a runtime hook into the application startup path, intercepted credentials as they were entered during LLM configuration, and shipped API keys to a secondary command-and-control endpoint, across CVE-2026-45312 and CVE-2026-28797 (Jinja2 server-side template injection in the prompt generator and Agent workflow), CVE-2026-24770 (MinerU parser path traversal), CVE-2025-68700 (Canvas CodeExec sandbox bypass), and CVE-2025-69286. Against Kestra, CVE-2026-49869 authentication bypass allowed unauthenticated workflow creation, shell execution through the Process runner, Docker socket enumeration for container environment secrets, and XMRig deployment that sweeps competing miners first. Payloads used multiple download and execution fallbacks, service-daemon masquerading, and out-of-band callbacks to `yosemite[.]jp`, `gobygo[.]net`, and `oast[.]me`. Microsoft's framing: "Gateways, retrieval platforms, orchestration services, and containerized runtimes now sit between users, applications, data, and models. These systems concentrate credentials, data access, model connectivity, and execution privileges, making them some of the most powerful components in the AI stack"

The AI control plane inherited the trust concentration of traditional control-plane infrastructure without inheriting its hardening conventions. These services hold every provider key, every data connection, and container execution rights in one place, and are deployed to the open internet with no egress restrictions and authentication that can be bypassed outright