AI 工具链被攻陷后的密钥轮换：2026 年 9 月 KEV 波次清单

Rotating Secrets After an AI-Tooling Compromise: A Checklist for the September 2026 KEV Wave Three of the seven vulnerabilities CISA added to its Known Exploited Vulnerabilities catalog on September 2, 2026 targeted AI and workflow tooling: BerriAI LiteLLM's authentication flaw CVE-2026-59822, the Kestra orchestrator's unauthenticated command-injection chain CVE-2026-49869, and the Starlette request-smuggling flaw CVE-2026-48710. On September 8 and 9, the catalog grew again with the Adobe Commerce template-injection flaw CVE-2026-75650 and N-able N-central's CVE-2026-86218, both carrying exploitation evidence. These platforms share one property that changes post-compromise response: they hold other systems' credentials. Patching closes the entry point. It does not close out the incident, because command execution on a credential hub exports the credentials. The September wave makes credential rotation an operational skill worth writing down. Why Patching Alone Is Insufficient Here A LiteLLM gateway stores provider API keys for OpenAI, Anthropic and other backends; public remediation guidance for CVE-2026-59822 includes checking ~/.ssh/authorized_keys on affected hosts, which indicates host-level persistence is part of the observed intrusion pattern. A Kestra instance holds the secrets its workflows use against databases, cloud APIs and internal services. An N-central instance manages credentials across entire customer fleets. In each case the attacker's prize is the secret store, and the secret store survives the patch. Rotation Checklist, in Order Patch or isolate the affected platform first. Rotation while the attacker still holds execution access only teaches them the new secrets. Remove persistence. Check authorized_keys, scheduled tasks, cron entries and startup scripts on affected hosts, per the public guidance for LiteLLM. Rotate the platform's stored secrets: provider API keys for gateways, workflow connection credentials for orchestrators, managed-device credentials for RMM tools. Rotate adjacent credentials that were reachable: cloud access keys attached to the host's identity, database accounts the workflows used, and any admin tokens the platform could issue. Review billing and audit logs for the rotated secrets' usage windows. Unexpected model API spend, unfamiliar database queries or off-hours logins establish whether the exported credentials were actually used. Rebuild rather than clean where feasible. For appliances like N-central, the vendor's guidance on compromise indicators should drive rebuild decisions, since inline persistence on security-management tools is designed to survive routine cleanup. The Billing Signal Most Teams Miss For AI gateways specifically, provider billing data is a detection source that most incident plans skip. Stolen model API keys are spent, and the spending shows up in usage dashboards before any internal alert fires. Reviewing token usage per key after a gateway incident is cheap and frequently decisive. Limits Rotation scope depends on dwell time, which is usually unknown. When in doubt, rotate everything the platform could reach and document the cost. The alternative, a narrow rotation based on optimistic assumptions, leaves the incident open with better-hidden credentials. References CISA KEV additions of September 2, 8 and 9, 2026. https://www.cisa.gov/known-exploited-vulnerabilities-catalog September 2026 weekly reporting on LiteLLM CVE-2026-59822 remediation, including the authorized_keys check. https://blog.csdn.net/weixin_41905135/article/details/165064980 September 2026 intelligence reporting on the Kestra and JFrog Artifactory KEV additions. https://blog.csdn.net/weixin_45635831/article/details/164379461