AI Gateway Exploitation: How Attackers Are Targeting LiteLLM, RAGFlow, and Kestra to Steal Your Model Provider Keys

This technical intelligence report documents active, high-severity campaigns (INT-2608-e7a5) targeting AI gateway and orchestration platforms—LiteLLM, RAGFlow, and Kestra—describing chained unauthenticated RCEs and path traversal vulnerabilities (multiple CVEs including CVSS 10.0 cases), observed credential theft and host compromise, IOCs, and recommended immediate mitigations including urgent patching, network segmentation, and secret-management best practices.