CISA Puts the AI Control Plane in KEV: LiteLLM, Kestra, Starlette, and Artifactory Added on One Day (CVE-2026-59822, CVE-2026-49869, CVE-2026-48710, CVE-2026-82329)

BerriAI LiteLLM gateways, Kestra OSS workflow orchestration, the Starlette ASGI framework that fronts much of the Python AI stack, and JFrog Artifactory

CISA added seven vulnerabilities to the Known Exploited Vulnerabilities catalog on September 2, 2026, four of them components of the AI control plane. CVE-2026-59822 (CVSS 8.8) is the LiteLLM authentication bypass in which a fabricated Authorization header triggers a faulty OAuth2 fallback and token validation failure returns an unrestricted `UserAPIKeyAuth()` object. CVE-2026-49869 (CVSS 10.0) is OS command injection in Kestra OSS. CVE-2026-48710 (CVSS 6.5) is the Starlette host-header validation bypass that lets an attacker inject paths into the host portion of a request, prepending the real path and producing authentication bypass. CVE-2026-82329 (CVSS 9.8) is improper authentication in JFrog Artifactory that hands an unauthenticated network attacker administrative privileges under the default configuration. The exploitation evidence came from the campaigns Microsoft and Wiz documented the week before: attackers chained CVE-2026-42271 with CVE-2026-48710 to break into LiteLLM gateways, pulled model configuration, upstream provider key material, provider endpoints, and proxy-issued virtual keys out of the backend database, and deployed XMRig; against Kestra they established reverse shells, enumerated the Docker environment, and stored curl-pipe-shell output through Kestra's own key-value interface. The other three additions were CVE-2026-9586 in Sangoma Switchvox and CVE-2026-83548 and CVE-2026-83549 in SonicWall SMA1000. Federal civilian agencies were given until September 5 for five of the flaws and September 16 for the Starlette and LiteLLM pair

Not new vulnerabilities. The significance is the composition of a single KEV batch: an AI gateway, a workflow orchestrator, the web framework underneath both, and the artifact registry they pull from, all confirmed under active exploitation on the same day. AI infrastructure has moved from research target to routine, federally mandated patching surface