On September 2, 2026, CISA appended seven vulnerabilities to its Known Exploited Vulnerabilities catalog. Three of the seven target AI and machine learning infrastructure. That's 42.8% of the batch. The first time AI components constitute nearly half the additions. This is not a statistical blip. It's a signal that the attack surface has shifted from the model to the orchestration layer. I've spent the last nine years auditing smart contracts and protocol logic. The patterns here are eerily familiar. Fail-open authentication. Path confusion. Default credentials. These are the same classes of bugs that have drained DeFi protocols for years. The difference is the target: now it's the infrastructure that powers agentic AI, MCP servers, and model inference. And the industry is treating it like a routine patch cycle. It's not. Let me break down the technical mechanics, the blind spots, and why the CVSS scores are dangerously misleading.
Context: The KEV Catalog and BOD 26-04
For the uninitiated, CISA's Known Exploited Vulnerabilities catalog is a list of vulnerabilities that have been confirmed as actively exploited in the wild. Federal agencies are mandated to remediate these within strict timelines. But BOD 26-04, which took effect earlier this year, replaced the old 21-day blanket deadline with a risk-based model. The new system uses SSVC—Stakeholder-Specific Vulnerability Categorization—to assign remediation windows of 3, 14, or 60 days. The window depends on asset exposure, KEV status, exploit automation, and technical impact. This is a rational shift. Not all vulnerabilities are equal. A CVSS 10.0 in an internal tool doesn't warrant the same urgency as a CVSS 6.5 in an internet-facing gateway. But the model assumes the scoring is accurate. That assumption is flawed, especially for AI infrastructure.
The three AI-specific CVEs in this batch are CVE-2026-59822 (LiteLLM), CVE-2026-48710 (Starlette/FastAPI), and CVE-2026-82329 (JFrog Artifactory). Each targets a distinct layer of the AI stack. LiteLLM is an AI gateway and proxy that sits between applications and multiple model providers. Starlette is the ASGI framework underlying vLLM, LiteLLM, and many MCP servers. JFrog Artifactory is the artifact repository used to store and distribute ML models, datasets, and dependencies. Together, they form the plumbing of modern AI pipelines. Compromise any one of them, and you're not just stealing a model—you're manipulating the entire agentic behavior.
Core: Technical Dissection of the AI Vulnerabilities
CVE-2026-59822: LiteLLM's OAuth2 Passthrough Fail-Open
Let's start with LiteLLM. The vulnerability allows an unauthenticated Model Context Protocol session via an arbitrary Bearer token. CVSS 8.8. Affects all versions prior to 1.84.0. The root cause is in the OAuth2 passthrough fallback. When key validation fails, the system replaces the failed validation with an empty auth object. This empty object then bypasses subsequent authorization checks. This is a classic fail-open pattern. I've seen this exact logic in smart contract access control. A developer writes a fallback that defaults to 'allow' instead of 'deny' because they assume the primary path will always succeed. The result is that any attacker who can craft a request with a Bearer token—any token, even a garbage one—gets through. The MCP session is then established without authentication. The attacker can invoke tools, read context, and potentially exfiltrate sensitive data. The fix is straightforward: fail closed. But the deeper issue is that the AI gateway is designed to be flexible. It supports multiple authentication methods, and the fallback logic was added to handle edge cases. That flexibility is the attack surface.
CVE-2026-48710: Starlette's Host Header Path Confusion
The second AI-specific CVE is in Starlette/FastAPI. The 'BadHost' vulnerability allows a trivial Host header injection to bypass path-based authentication middleware. CVSS 6.5. But researchers argue this score materially understates real-world risk. I agree. The mechanism is subtle. A single malformed character in the Host header—/, ?, or #—shifts path boundaries during URL reconstruction. When the ASGI server reconstructs the request URL, it uses the Host header to build the absolute URL. If the Host header contains a slash, the path portion of the URL gets confused. The result is that request.url.path differs from the path the router dispatched. Authentication middleware that checks the path to decide whether to enforce auth can be tricked. For example, if the middleware protects /admin, an attacker can send a Host header like example.com/admin and a request path of /—the reconstructed URL path becomes /admin, but the router dispatches to /. The middleware sees /admin and thinks it's protected, but the actual handler is the root. Or vice versa. This is a path confusion attack. It's not new. We've seen similar issues in web frameworks for years. But in the context of AI infrastructure, the impact is amplified. Starlette is the foundation for vLLM, which serves model inference. If an attacker can bypass authentication on a vLLM endpoint, they can send arbitrary prompts, extract model outputs, or even cause denial of service. The CVSS 6.5 assumes the attacker needs some access. But in practice, many deployments expose these endpoints to the internet without proper network segmentation. The real-world exploitability is much higher.
CVE-2026-82329: JFrog Artifactory's Phantom Join Key
The third AI-specific CVE is in JFrog Artifactory. Under default configuration, a 'phantom' join key allows forging administrator tokens. CVSS 9.8. WatchTowr observed in-the-wild exploitation on September 1—four days after disclosure. Attackers minted admin tokens and enumerated users, groups, and credential sets. This is a default misconfiguration. The join key is a shared secret used to authenticate nodes in a cluster. In the default setup, the key is predictable or empty, allowing an attacker to generate a valid admin token. This is the kind of bug that should never exist in a production artifact repository. But it does. And the exploitation timeline is telling: four days from disclosure to active exploitation. That's faster than most organizations can patch. The impact is severe because Artifactory stores not just code but also ML models, which can be poisoned. An attacker with admin access can replace a model with a backdoored version. The downstream effect is that any system that pulls that model is compromised. This is a supply chain attack vector that goes beyond traditional software.
The Other Four: Persistent Enterprise Threats
While the AI-specific CVEs dominate the narrative, the other four are equally concerning. CVE-2026-49869 in Kestra OSS carries a CVSS 10.0—a suffix-match authentication bypass in AuthenticationFilter. Any path ending in '/configs' skips authentication entirely, yielding unauthenticated RCE as root. Kestra is an orchestration platform used for data pipelines, often in AI/ML workflows. The remediation window is 3 days—by September 5. That's aggressive. CVE-2026-81578 and CVE-2026-82078 in PaperCut NG/MF form a chained zero-day pair for pre-authentication RCE. Huntress confirmed active exploitation since August 26. PaperCut is a print management system, but it's often on internal networks. The chain allows an unauthenticated attacker to execute arbitrary code. CVE-2026-83549 in SonicWall SMA1000 is a post-authentication command injection chained with a pre-authentication SSRF, linked to ransomware gang activity. These are not AI-specific, but they highlight the broader trend: attackers are targeting edge devices and orchestration layers.
Contrarian: The CVSS Scores Are a Dangerous Distraction
Here's where I diverge from the mainstream analysis. The CVSS scores for these vulnerabilities are not just inaccurate—they're actively harmful. The Starlette vulnerability at 6.5 is a prime example. The score assumes a low attack complexity and some required privileges. But in the context of AI infrastructure, the attack complexity is trivial. A single malformed character in a Host header. No privileges required. The only mitigating factor is that the target must be using path-based authentication middleware. But that's a common pattern. The score should be at least 8.0. The LiteLLM vulnerability at 8.8 is closer, but it still understates the impact because it doesn't account for the value of the data accessible through MCP sessions. An attacker who compromises a LiteLLM gateway can potentially access every model provider the gateway proxies. That's not just a single system—it's a pivot point. The JFrog Artifactory at 9.8 is appropriately severe, but the default configuration issue means that many deployments are vulnerable without any attacker sophistication. The real problem is that the CVSS framework is designed for traditional IT systems. It doesn't account for the cascading effects of AI supply chain compromise. A model poisoning attack can have long-term consequences that are not captured in a single vulnerability score.
But there's a deeper blind spot. The KEV catalog is reactive. It lists vulnerabilities that are already being exploited. By the time a CVE is added, the damage is often done. The AI-specific additions are a wake-up call, but they're also a lagging indicator. The real question is: what vulnerabilities are being exploited right now that haven't been disclosed? Based on my experience auditing zero-knowledge circuits and oracle networks, I can tell you that the AI stack is full of similar fail-open patterns. The OAuth2 passthrough in LiteLLM is not an isolated incident. It's a symptom of a development culture that prioritizes flexibility over security. The Starlette path confusion is a classic web framework bug that has been known for years. The fact that it's now being exploited in AI infrastructure means that the AI industry is adopting the same insecure patterns that plagued web 2.0.
Another contrarian angle: the remediation timelines are unrealistic. BOD 26-04 gives Kestra a 3-day window. That's for a CVSS 10.0 vulnerability with active exploitation. But Kestra is an open-source orchestration tool. Many organizations run it on-premises with custom configurations. Patching within 3 days requires a mature security operations team, automated patch management, and the ability to test the patch without breaking production. Most AI startups don't have that. They're moving fast, iterating on models, and treating security as an afterthought. The result is that the 3-day window will be missed, and the vulnerability will remain exploitable for weeks. The SSVC model assumes that organizations have the capacity to respond. That assumption is false for the AI sector.
Takeaway: The AI Stack Is the New DeFi
I've been in this industry long enough to see patterns repeat. In 2020, DeFi protocols were hacked because of reentrancy, integer overflow, and access control flaws. The same classes of bugs are now appearing in AI infrastructure. The KEV catalog is the equivalent of the first major DeFi exploits. It's a signal that the attackers have figured out where the value is. The value is not in the model weights—it's in the orchestration layer that controls access to those models. The MCP ecosystem is particularly vulnerable because it's new, rapidly adopted, and built on frameworks that were never designed for adversarial environments. LiteLLM and Starlette are the new Solidity and Vyper. The vulnerabilities are not exotic. They're basic authentication and authorization failures. But the impact is amplified because the data flowing through these systems is sensitive—proprietary models, user prompts, business logic.
What does this mean for the future? I predict that we'll see more AI-specific KEV additions in the coming months. The attack surface is expanding faster than the security community can keep up. The industry needs to adopt a fail-closed mindset. Every authentication fallback should default to deny. Every path-based middleware should be tested with malformed Host headers. Every artifact repository should have its default keys rotated. But more fundamentally, we need to treat AI infrastructure as critical infrastructure. The same rigor that we apply to smart contract audits—formal verification, fuzzing, adversarial testing—needs to be applied to AI gateways, ASGI frameworks, and model registries. The cost of a compromise is not just a data breach. It's the potential to manipulate the behavior of autonomous agents. That's a systemic risk that no CVSS score can capture.
I've audited protocols where a single line of code could drain millions. The AI stack is no different. The only difference is that the exploit is not a flash loan—it's a prompt injection. And the remediation window is not 21 days—it's 3. The question is not whether the AI stack will be compromised. It's whether the industry will learn from the DeFi playbook before the next batch of KEV additions. Based on the current trajectory, I'm not optimistic. But I'm also not surprised. The patterns are always the same. Fail-open. Path confusion. Default credentials. The only thing that changes is the acronym.
⚠️ Deep article forbidden. This is not a feature; it's a liability. ⚠️ Deep article forbidden. The model is not the target; the gateway is. ⚠️ Deep article forbidden. CVSS is a lagging indicator, not a risk assessment.
— Nathan Smith, Core Protocol Developer