Microsoft warns of attacks on LiteLLM, RAGFlow

Microsoft detected real attacks against LiteLLM, RAGFlow and Kestra in which attackers stole AI model keys, accessed databases and containers, established persistence on servers, and deployed cryptocurrency miners. The company said it was highly confident the initial foothold came through an internet-exposed gateway.

What did Microsoft see in LiteLLM and RAGFlow?

Microsoft found that attackers intercepted settings when a user added or changed a connection to a language model, then captured the provider name, model, API key and service address. That behavior was observed with credentials for OpenAI, Azure, Anthropic and Gemini.

In RAGFlow, Microsoft's Security blog said the attackers modified the TenantLLM.insert() method to intercept, during each model configuration event, the API keys and connection parameters before exfiltrating them to a secondary command-and-control server. SecurityLab Latam also linked the case to possible exploitation paths associated with CVE-2026-42271 and CVE-2026-48710, although an independent analysis clarified that Microsoft did not present those CVEs as confirmed causes in every case, but as relevant public vulnerability paths.

What happened in Kestra?

In Kestra, Microsoft tied the initial access with high confidence to CVE-2026-49869, a critical flaw in the authentication filter that let a remote, passwordless user create and run their own workflows. A technical note from CybersecurityNews added that attackers used that flaw to create malicious workflows that instructed workers to execute shell commands.

Microsoft also said that, once inside, attackers used access to the Docker socket to enumerate the environment variables of all containers through Config.Env and extract embedded secrets such as database credentials, cloud keys and API keys. According to the company, that widened the impact beyond the originally compromised system.

What vulnerabilities and technical patterns were described?

A technical report on MCP said CVE-2026-42271 affected LiteLLM from versions 1.74.2 through 1.83.6, and was fixed in 1.83.7. The report explained that MCP test endpoints accepted configurations with a command field that was passed directly to a child process without validation.

Another investigation into AI infrastructure honeypots described an attack pattern in which actors exploited CVE-2026-42271 with an MCP setup based on stdio, downloaded and ran a miner identified as gmon, and returned a syntactically valid MCP response so the connection test would appear successful. The same analysis said CISA added that CVE to its KEV catalog in June 2026, confirming active exploitation beyond the cases Microsoft observed.

On CVE-2026-48710, a technical analysis explained that it was a flaw in Host header validation in Starlette, originally documented in the BadHost report, fixed in Starlette 1.0.1, and referenced by the Belgian Cybersecurity CERT. SecurityLab Latam said that, in certain configurations, combining that issue with CVE-2026-42271 could allow code execution without valid credentials.

What did Microsoft recommend?

Microsoft urged organizations not to publish administrative interfaces for these systems directly to the internet, to install updates regularly, to separate user keys from the model providers' master keys, and to store secrets in specialized vaults rather than environment variables. It also classified AI gateways as high-criticality control points and recommended treating them as Tier 0 assets, on par with domain controllers or identity management systems.

A Cyber Roundtable executive summary said the common pattern across LiteLLM, RAGFlow and Kestra was credential theft, persistence and monetization of compromised compute through cryptomining, with a financial motive overriding traditional espionage. That again puts the exposure of AI gateways and infrastructure configurations used in cloud environments into focus, including services such as OpenAI, Azure, Anthropic and Gemini.