# The AI Gateway Becomes a Target: Measuring LiteLLM and Kestra Exposure > Source: > Published: 2026-09-18 22:20:07+00:00 The CISA Known Exploited Vulnerabilities catalog update on September 2, 2026, marked a shift. Among the seven newly listed flaws were vulnerabilities in LiteLLM, an AI gateway, and Kestra, a workflow orchestration platform. For the first time, AI infrastructure components appeared as confirmed exploitation targets alongside traditional VPN and web-framework flaws. That makes their internet exposure worth measuring. LiteLLM (CVE-2026-59822, an improper authentication flaw rated CVSS 8.8) and Kestra (CVE-2026-49869, an OS command injection rated CVSS 10.0) are not edge appliances in the traditional sense. They are application-layer services that organizations deploy to route model requests and orchestrate data workflows. Because they often hold API keys to large language models and other sensitive services, a compromise can expose credentials rather than just compute. The counts below were collected with ZoomEye on 2026-09-19 using sub_type "all" and a page size of one, so each figure is the matched total. Query strings are included for reproducibility. These counts describe internet-facing assets matching a fingerprint, not confirmed vulnerable instances. `app="LiteLLM"` returned 34,412 matches, indicating a substantial number of internet-facing AI gateway deployments.`app="Kestra"` returned 126 matches, a much smaller footprint consistent with a more specialized orchestration tool.`app="Langflow"` returned 18,448 matches, another AI-adjacent platform with meaningful exposure.`app="Metabase"` returned 115,725 matches, a widely deployed analytics tool that has also appeared in exploitation reporting. The contrast between the AI-infrastructure counts is instructive. LiteLLM's larger footprint reflects how commonly AI gateways are deployed as shared services, often reachable by many internal clients and, in some cases, the internet. Kestra's smaller count does not make it less dangerous; a single exposed orchestration platform with command-execution potential is a serious risk. AI infrastructure deserves the same exposure discipline as traditional services. These platforms frequently hold high-value secrets: model provider API keys, database credentials, and workflow tokens. When such a service is internet-reachable and unpatched, the consequence is not just service disruption but credential theft at scale. The measurement supports a concrete workflow. An organization can query for its AI gateways and orchestration tools, compare the result to its inventory, and verify that none of them are exposed to the public internet. Any match that the organization did not expect is an immediate finding.