Three AI-adjacent CVEs hit CISA’s KEV catalog in a single month: the LiteLLM proxy auth bypass (CVE-2026-42208) that exposes every conversation your org ever had with a model, a Linux kernel flaw (CVE-2026-31431) that reaches GPU training clusters, and PAN-OS exploitation (CVE-2026-0300) used as the beachhead into AI infrastructure. “Living off the LLM” is the new living-off-the-land.
“Living Off the LLM” is the 2026 threat class where attackers compromise AI infrastructure itself rather than abusing AI to write phishing. In one month CISA added CVE-2026-42208 (LiteLLM proxy auth bypass — exposes API keys, prompt history, and internal documents), CVE-2026-31431 (Linux kernel privesc reaching GPU/model training clusters), and CVE-2026-0300 (PAN-OS perimeter exploit used to reach AI proxy endpoints) to the KEV catalog. Defense priorities: patch all three now, treat your LLM proxy as a crown-jewel database, disable raw prompt logging, and put the AI stack behind zero-trust segmentation.
The New Attack Surface: AI as Infrastructure
In 2024, we worried about prompt injection. In 2025, we focused on AI supply chain attacks — the pattern behind the Mercor/LiteLLM breach. But 2026 has revealed something far more concerning: AI infrastructure itself has become the target. The CVE-2026-42208 vulnerability in LiteLLM — a proxy used by thousands of organizations to manage LLM API calls — demonstrated that the AI stack is now as critical as the web server stack was in 2010. For the full April picture, see our AI infrastructure under attack analysis.
This isn’t theoretical. Attackers are actively exploiting AI proxy layers, model serving infrastructure, and agentic frameworks. Here’s what every security professional needs to know about this emerging threat class.
Understanding the AI Attack Stack
Before diving into specific vulnerabilities, let’s map the modern AI infrastructure stack that attackers are targeting:
┌─────────────────────────────────┐
│ Application Layer │
│ (Chatbots, Agents, Copilots) │
├─────────────────────────────────┤
│ Orchestration Layer │
│ (LangChain, CrewAI, AutoGen) │
├─────────────────────────────────┤
│ Proxy/Gateway Layer │
│ (LiteLLM, OpenRouter, vLLM) │
├─────────────────────────────────┤
│ Model Serving Layer │
│ (TGI, Triton, Ollama) │
├─────────────────────────────────┤
│ Infrastructure Layer │
│ (GPU Clusters, CUDA, Drivers) │
└─────────────────────────────────┘Each layer introduces new attack vectors that didn’t exist in traditional web infrastructure.
CVE-2026-42208: The LiteLLM Wake-Up Call
CVE-2026-42208 was added to CISA’s Known Exploited Vulnerabilities catalog on May 8, 2026. LiteLLM is an open-source proxy that translates requests between different LLM providers, used by organizations to:
- Manage API keys across multiple LLM providers
- Track token usage and costs
- Implement access controls for AI services
- Route requests to different models
The vulnerability allows attackers to bypass authentication and access controls, potentially gaining access to:
- API keys for LLM providers (OpenAI, Anthropic, Google, etc.)
- Prompt history — every conversation your organization has had with AI models
- Internal documents that were processed through the AI pipeline
- Model configurations including system prompts and fine-tuning data
Why This Matters
Think about what flows through your LLM proxy:
User Query → LiteLLM Proxy → OpenAI/Anthropic/Google
↓
Logs contain:
- Customer PII
- Internal strategy documents
- Source code snippets
- Authentication credentials
- Legal/medical/financial dataAn attacker who compromises your AI proxy doesn’t just get access to your AI — they get access to everything your organization has ever asked an AI about. This is a data breach of unprecedented scale, and most organizations don’t even realize it.
CVE-2026-31431: Kernel-Level AI Exploitation
Another critical vulnerability added to the KEV catalog on May 1, 2026 targets the Linux kernel. While not AI-specific, this is relevant because:
- GPU compute clusters run on Linux
- Model training infrastructure depends on kernel stability
- Container orchestration (Kubernetes) sits on top of the kernel
An attacker exploiting CVE-2026-31431 could:
- Escalate privileges on AI training infrastructure
- Access GPU memory where model weights are stored
- Inject malicious code into the training pipeline
- Exfiltrate proprietary models during training
CVE-2026-0300: PAN-OS — The Network Perimeter Strikes Back
Added to KEV on May 6, 2026, this Palo Alto Networks vulnerability reminds us that while we’re focused on AI threats, traditional network infrastructure remains under active exploitation.
The attack chain combining CVE-2026-0300 with AI-targeting techniques looks like this:
- Exploit PAN-OS to gain network perimeter access
- Identify AI proxy endpoints through network traffic analysis
- Lateral movement to AI infrastructure
- Data exfiltration through the AI proxy’s logging mechanism
The WordPress Connection: CVE-2026-41940
For the WordPress community, CVE-2026-41940 targeting cPanel & WHM is particularly concerning. Added to KEV on April 30, 2026 — our full breakdown is in the cPanel authentication bypass analysis — this vulnerability affects:
- WordPress hosting environments using cPanel
- WordPress management platforms
- Automated WordPress deployment tools
Protecting Your WordPress Site
Given that this is a cybersecurity blog running on WordPress, here are concrete steps:
- Update cPanel immediately if you’re on a shared hosting environment
- Audit WordPress plugins — disable any you’re not actively using
- Enable WordFence WAF (currently disabled on many sites for compatibility)
- Review user accounts — delete any admin accounts you don’t recognize
- Enable two-factor authentication for all admin accounts
Other Notable Recent CVEs
| CVE | CVSS | Target | Risk |
|---|---|---|---|
| CVE-2026-4668 | 6.5 | WordPress Amelia Plugin | SQL Injection |
| CVE-2025-71279 | 9.8 | XenForo | Passkey Authentication Bypass |
| CVE-2025-71278 | 8.8 | XenForo | OAuth2 Unauthorized Scopes |
| CVE-2026-6973 | — | EPMM | Mobile Device Management Bypass |
| CVE-2026-32202 | — | Windows | Privilege Escalation |
The Broader Trend: AI Infrastructure as Critical Infrastructure
What these vulnerabilities collectively reveal is a fundamental shift in the threat landscape:
From Application Security to AI Supply Chain Security
Traditional AppSec focuses on your code. But in the AI era, your attack surface includes:
- Third-party model providers (OpenAI, Anthropic, Google)
- Open-source AI frameworks (LangChain, LlamaIndex, LiteLLM)
- Model registries (Hugging Face, Ollama Hub)
- AI proxy services (OpenRouter, Azure AI Gateway)
- Training data pipelines (web scrapers, document processors)
- GPU infrastructure (NVIDIA, cloud GPU providers)
This is the same dependency-inheritance problem we mapped in software supply chain security — one layer deeper.
The “AI Blast Radius” Problem
When a traditional web application is compromised, the blast radius is limited to that application’s data. When an AI infrastructure component is compromised:
- Every downstream application using that component is affected
- Historical data in logs becomes accessible
- Model behavior can be subtly altered
- User trust in AI outputs is permanently damaged
Defensive Strategies for 2026
1. Treat AI Infrastructure Like Crown Jewels
Your AI proxy is as sensitive as your database.
Your model weights are as valuable as your source code.
Your prompt logs are as sensitive as your email archives.2. Implement Zero Trust for AI Services
- Authenticate every request to your AI proxy (no network-based trust)
- Encrypt all AI traffic in transit and at rest
- Segment AI infrastructure from general compute
- Monitor AI API usage for anomalous patterns
The same principles apply as in zero-trust architecture for AI systems — but stretched to cover infrastructure that answers at API speed.
3. Secure the AI Proxy Layer
Specifically for LiteLLM and similar proxies:
# Bad: Default LiteLLM configuration
litellm_settings = {
"master_key": "sk-xxx", # Single key for everything
"database_url": "postgresql://..." # Logs all conversations
}
# Good: Hardened configuration
litellm_settings = {
"master_key": None, # No master key
"auth_required": True,
"user_api_key_auth": True,
"max_budget": 100, # Limit per-user spend
"log_raw_request_response": False, # Don't log PII
"allowed_model_aliases": ["gpt-4o", "claude-3.5"], # Whitelist
}4. Audit Your AI Data Footprint
Ask yourself:
- What data are we sending to LLM providers?
- Where are conversation logs stored?
- Who has access to our AI proxy?
- How long do we retain prompt history?
- Are system prompts containing sensitive information?
5. Build AI Incident Response Capabilities
Traditional IR plans don’t cover AI-specific scenarios. You need:
- AI log analysis procedures
- Model integrity verification processes
- AI proxy containment playbooks
- Regulatory notification procedures for AI data breaches
The Road Ahead
The weaponization of AI infrastructure is still in its early stages. But the addition of three AI-related CVEs to CISA’s KEV catalog in a single month signals that nation-state and criminal actors are actively targeting this space.
For cybersecurity professionals, the message is clear: your AI stack is now part of your attack surface. The tools and frameworks you adopted to accelerate development have become the very infrastructure that attackers are learning to exploit.
Stay vigilant. Patch immediately. And remember: in 2026, securing your AI infrastructure is as important as securing your web server was in 2006.
Frequently Asked Questions
What does “Living Off the LLM” mean?
It’s the AI-era equivalent of “living off the land” attacks: instead of bringing their own malware, attackers compromise the AI infrastructure already inside your environment — LLM proxies (LiteLLM, OpenRouter), model serving stacks (TGI, Triton, Ollama), and orchestration frameworks — and weaponize its credentials, logs, and trust position.
What does CVE-2026-42208 expose?
The LiteLLM proxy authentication bypass can expose provider API keys, complete prompt/conversation history, internal documents processed through the AI pipeline, and model configurations including system prompts and fine-tuning data — effectively everything your organization has ever asked an AI about.
Is a kernel CVE really an AI security issue?
CVE-2026-31431 shows why the boundary is blurring: GPU clusters, model training pipelines, and Kubernetes orchestration all sit on the Linux kernel. Kernel privilege escalation on training infrastructure means access to GPU memory, model weights, and the ability to poison training runs.
How do I start securing my AI stack today?
Patch the three May 2026 KEV entries first (LiteLLM, kernel, PAN-OS), then harden your proxy configuration: disable the master key, require per-user auth, turn off raw request/response logging, whitelist model aliases, cap per-user budgets, and segment AI infrastructure behind zero-trust controls.
References
- CISA — Known Exploited Vulnerabilities catalog additions: CVE-2026-42208 (May 8, 2026), CVE-2026-31431 (May 1, 2026), CVE-2026-0300 (May 6, 2026), CVE-2026-41940 (Apr 30, 2026)
- NVD — CVE-2026-4668, CVE-2025-71279, CVE-2025-71278, CVE-2026-6973
- Hmmnm — AI Infrastructure Under Attack: April 2026 CVE Analysis
- Hmmnm — The AI Inversion: 6 Real Incidents That Redefined Cybersecurity
- Hmmnm — cPanel CVE-2026-41940 Authentication Bypass Analysis
- Hmmnm — Software Supply Chain Security: Dependencies, Builds, Secrets
- Hmmnm — Microsoft April 2026 Patch Tuesday Analysis
Prabhu Kalyan Samal is an Application Security Consultant specializing in AI security, penetration testing, and secure architecture. He holds certifications including CompTIA SecurityX, Certified Red Team Operator, and Azure Security Engineer.
Related Reading
Part of our AI Agent Security: The Complete Guide (2026) series.
n
