Three of the seven vulnerabilities CISA added to its Known Exploited Vulnerabilities catalog on September 2, 2026 targeted AI and workflow tooling: BerriAI LiteLLM's authentication flaw CVE-2026-59822, the Kestra orchestrator's unauthenticated command-injection chain CVE-2026-49869, and the Starlette request-smuggling flaw CVE-2026-48710. On September 8 and 9, the catalog grew again with the Adobe Commerce template-injection flaw CVE-2026-75650 and N-able N-central's CVE-2026-86218, both carrying exploitation evidence. These platforms share one property that changes post-compromise response: they hold other systems' credentials.
Patching closes the entry point. It does not close out the incident, because command execution on a credential hub exports the credentials. The September wave makes credential rotation an operational skill worth writing down.
A LiteLLM gateway stores provider API keys for OpenAI, Anthropic and other backends; public remediation guidance for CVE-2026-59822 includes checking ~/.ssh/authorized_keys on affected hosts, which indicates host-level persistence is part of the observed intrusion pattern. A Kestra instance holds the secrets its workflows use against databases, cloud APIs and internal services. An N-central instance manages credentials across entire customer fleets. In each case the attacker's prize is the secret store, and the secret store survives the patch.
authorized_keys, scheduled tasks, cron entries and startup scripts on affected hosts, per the public guidance for LiteLLM.
For AI gateways specifically, provider billing data is a detection source that most incident plans skip. Stolen model API keys are spent, and the spending shows up in usage dashboards before any internal alert fires. Reviewing token usage per key after a gateway incident is cheap and frequently decisive. Rotation scope depends on dwell time, which is usually unknown. When in doubt, rotate everything the platform could reach and document the cost. The alternative, a narrow rotation based on optimistic assumptions, leaves the incident open with better-hidden credentials.