On September 2, 2026, CISA appended seven entries to its Known Exploited Vulnerabilities catalog. Three target AI and machine learning infrastructure. That's 42.8% of the batch. The first time AI components constitute nearly half the additions. This is not a statistical anomaly. It's a signal that the agentic web is now a primary attack surface. And the vulnerabilities themselves are not exotic zero-days. They are mundane authentication failures, dressed in the language of AI gateways and model context protocols. The real story is not the CVEs. It's the architectural assumption that a gateway can be trusted to validate identity. That assumption is broken. — Nathan Smith
Let's dissect the three AI-specific entries. CVE-2026-59822 hits LiteLLM, the AI gateway and proxy that sits between applications and dozens of LLM providers. The vulnerability allows an unauthenticated Model Context Protocol session via an arbitrary Bearer token. All versions prior to 1.84.0 are affected. CVSS 8.8. The root cause is an OAuth2 passthrough fallback. When key validation fails, the system replaces the failed validation with an empty auth object. Subsequent authorization checks see an empty object and assume the request is legitimate. This is a classic fail-open pattern. I've seen the same logic in smart contract access control—a require statement that silently returns true instead of reverting. The result is that any attacker can mint a session by sending any Bearer token, even a garbage string. The gateway then forwards the request to the underlying model, exposing prompts, context, and potentially system prompts. The attacker doesn't need to touch the model. They just need to pass through the gate. — Nathan Smith
CVE-2026-48710 targets Starlette/FastAPI, the ASGI framework that underpins vLLM, LiteLLM, and many MCP servers. The "BadHost" vulnerability is a Host header injection that bypasses path-based authentication middleware. A single malformed character in the Host header—/, ?, or #—shifts path boundaries during URL reconstruction. The request.url.path becomes different from the path the router dispatched. Authentication middleware checks one path, the router dispatches another. The mismatch allows an attacker to access protected endpoints without credentials. CVSS 6.5. But that score is a lie. Researchers argue it materially understates real-world risk. Why? Because the attack is trivial to execute, requires no authentication, and affects the most common Python web framework in the AI ecosystem. Every FastAPI app that uses path-based auth is vulnerable. That includes MCP servers, which are designed to expose agentic tools. The Host header is a fundamental part of HTTP. The fact that a single character can break path integrity is a design flaw in the ASGI spec, not just an implementation bug. — Nathan Smith
CVE-2026-82329 affects JFrog Artifactory, the artifact repository used in AI/ML pipelines. Under default configuration, a "phantom" join key allows forging administrator tokens. WatchTowr observed in-the-wild exploitation on September 1—four days after disclosure. Attackers minted admin tokens, enumerated users, groups, and credential sets. CVSS 9.8. This is not a subtle bug. It's a default configuration that ships with a hardcoded or predictable join key. The phantom key is likely a leftover from a development environment, but it's present in production. The exploitation timeline is telling: disclosure on August 28, exploitation on September 1. That's a 96-hour window. The KEV catalog added it on September 2. The remediation clock started then. But the damage was already done. Artifactory is the supply chain for AI models. Compromise it, and you can inject malicious weights, poison training data, or exfiltrate proprietary models. The attack surface is not just the repository—it's the entire ML pipeline that depends on it.
The remaining four CVEs address persistent enterprise threats. CVE-2026-49869 in Kestra OSS carries a CVSS 10.0—a suffix-match authentication bypass in AuthenticationFilter. Any path ending in "/configs" skips authentication entirely, yielding unauthenticated RCE as root. This is a textbook example of a path normalization flaw. The filter checks if the path starts with a protected prefix, but fails to check if it ends with a sensitive suffix. An attacker can append "/configs" to any path and bypass the filter. The result is full system compromise. CVE-2026-81578 and CVE-2026-82078 in PaperCut NG/MF form a chained zero-day pair for pre-authentication RCE. Huntress confirmed active exploitation since August 26. The chain likely involves a path traversal to read a configuration file, then a deserialization bug to achieve code execution. PaperCut is a print management system, but it's often deployed on internal networks with access to sensitive data. The final CVE, CVE-2026-83549 in SonicWall SMA1000, is a post-authentication command injection chained with a pre-authentication SSRF. It's linked to ransomware gang activity. The SSRF allows the attacker to reach internal services, and the command injection gives them a foothold. This is a classic two-step attack.
Now, the context. CISA's KEV catalog is not a vulnerability database. It's a list of actively exploited flaws that federal agencies must patch. The remediation timelines are governed by BOD 26-04, which replaced the old 21-day blanket deadline with a risk-based SSVC model. Components face 3-, 14-, or 60-day remediation windows depending on asset exposure, KEV status, exploit automation, and technical impact. Kestra CVE-2026-49869 requires remediation by September 5—three days after its KEV addition. That's aggressive. But it's also necessary. The vulnerability is a CVSS 10.0 with unauthenticated RCE. The SSVC model correctly prioritizes it. However, the model has a blind spot: it doesn't account for the complexity of AI infrastructure. Many AI components are deployed in ephemeral environments, with auto-scaling and dynamic routing. Patching a LiteLLM gateway in three days is not trivial when you have to coordinate with multiple model providers and ensure zero downtime. The 3-day window is unrealistic for most organizations. But that's the point. BOD 26-04 is designed to force action, not to be comfortable.
The inclusion of LiteLLM and Starlette confirms that components central to the MCP ecosystem are being actively targeted in production. Both vulnerabilities expose the same attack surface: how agents authenticate and route requests. Compromise of these layers provides a direct path for attackers to manipulate agentic behavior or exfiltrate sensitive context without touching the model itself. This is the key insight. The model is not the target. The gateway is. The agent is not the target. The routing layer is. In my experience auditing zero-knowledge circuits, I've seen a similar pattern: the proof system is sound, but the circuit compiler has a bug. Here, the model is sound, but the gateway has a bug. The industry spends billions on model alignment and safety, but the authentication layer is often an afterthought. This is a fundamental misallocation of resources.
Let's go deeper into the technical mechanics. The LiteLLM vulnerability is a fail-open OAuth2 fallback. The code likely looks like this: try: validate_token(request) except: auth = {} — then later, if auth.get('user'): authorize(). The empty dict is falsy, but the code might check for the presence of a key, not its truthiness. If the check is if 'user' in auth, then an empty dict fails, but if the check is if auth.get('user'), it also fails. So how does the bypass work? The vulnerability description says "arbitrary Bearer token" and "OAuth2 passthrough fallback replaces failed key validation with an empty auth object, bypassing subsequent authorization checks." This suggests that the fallback sets auth = {} and then the authorization logic treats an empty object as a valid session. Perhaps the code does if auth: authorize() but {} is falsy, so that would fail. More likely, the code does if auth is not None: authorize() — and an empty dict is not None. So the authorization passes. This is a classic Python pitfall: checking for None instead of checking for content. I've seen this exact bug in smart contract access control, where a function returns an empty struct instead of reverting. The fix is to validate the auth object's required fields, not just its existence. The Starlette vulnerability is more subtle. The Host header injection works because the ASGI server reconstructs the URL from the Host header. If the Host header contains a /, the path becomes ambiguous. For example, if the original path is /admin, and the Host header is example.com/, the reconstructed URL might be example.com//admin or example.com/admin? The vulnerability description says a single malformed character shifts path boundaries. The router uses the raw path from the request, while the authentication middleware uses the reconstructed path. If they differ, the middleware might see /admin and allow it, while the router sees /admin and dispatches to a protected endpoint. The fix is to use a single source of truth for the path, or to reject malformed Host headers outright. The JFrog Artifactory vulnerability is a default configuration issue. The "phantom" join key is likely a hardcoded value in the default config file. Attackers can read the default config from the documentation or from a public GitHub repo. The fix is to generate a random join key on first startup, not to ship with a known value.
Now, the contrarian angle. The security community is celebrating CISA's inclusion of AI vulnerabilities as a sign of maturity. I argue the opposite. The KEV catalog is a reactive mechanism. It lists vulnerabilities that are already being exploited. By the time a CVE is added, the damage is done. The three AI-specific vulnerabilities were all disclosed and exploited within days. The KEV catalog is not a warning; it's a post-mortem. The real issue is that the AI industry has been building infrastructure at breakneck speed, without applying the security lessons learned from decades of web development. The OAuth2 fallback bug is a textbook example of a fail-open pattern that has been known since the early 2000s. The Host header injection is a variant of the classic HTTP request smuggling. The phantom join key is a default credential issue. These are not novel attacks. They are the same mistakes, repeated in a new context. The AI hype cycle has created a false sense of novelty, but the underlying code is just as vulnerable as any enterprise software. The second contrarian point: the CVSS scores are misleading. The Starlette vulnerability has a CVSS of 6.5, which is considered "medium." But the real-world impact is far higher. Because Starlette is the foundation for vLLM, LiteLLM, and MCP servers, a single vulnerability affects thousands of deployments. The CVSS score doesn't account for the centrality of the component. A vulnerability in a widely used library should be scored higher than a vulnerability in a niche application, even if the technical impact is the same. The SSVC model tries to address this with the "technical impact" and "exploit automation" factors, but it still relies on the CVSS base score. The base score is calculated in isolation, without considering the ecosystem. This is a fundamental flaw in vulnerability management.
Another contrarian angle: the focus on AI-specific vulnerabilities is a distraction. The other four CVEs—Kestra, PaperCut, SonicWall—are equally critical, but they don't get the same attention because they don't have the "AI" label. The Kestra vulnerability is a CVSS 10.0 with unauthenticated RCE. That's worse than any of the AI-specific ones. But the media coverage is dominated by LiteLLM and Starlette because they are associated with the AI narrative. This is a misallocation of attention. Attackers don't care about the AI label. They care about the attack surface. PaperCut is a print management system, but it's often deployed on internal networks with access to sensitive data. The SonicWall SMA1000 is a VPN appliance, which is a prime target for ransomware. These are not less important than AI gateways. They are just less glamorous. The security community needs to treat all vulnerabilities with equal rigor, regardless of the buzzword attached to them.
Finally, the takeaway. The KEV catalog's AI awakening is not a milestone. It's a warning. The authentication failures in LiteLLM, Starlette, and JFrog Artifactory are symptoms of a deeper problem: the industry is building agentic systems without a coherent security model. The Model Context Protocol is designed to standardize how agents communicate, but it doesn't specify how authentication should work. Each gateway implements its own ad-hoc solution, and these solutions are failing. The next wave of vulnerabilities will likely target the MCP servers themselves, or the orchestration layers that coordinate multiple agents. The remediation timelines will become even more aggressive, and the attack surface will expand. The question is not whether we will see more AI-specific KEV entries. The question is whether the industry will learn from these failures or continue to repeat them. Based on my experience auditing smart contracts and zero-knowledge circuits, I'm not optimistic. The pattern is always the same: a new technology emerges, security is an afterthought, and then the exploits follow. The only difference is the vocabulary. — Nathan Smith
