MLflow AI Gateway SSRF can leak data if authenticated (CVE-2026-71211)
ZDI rates the authenticated flaw 7.7; the snippet does not name versions or a patch.
Stories per day · 30 days
5 RSS
Relatedopen-source3litellm2bifrost1information-disclosure1jev1kong1llm-infrastructure1mcp1mlflow1model-adoption1plugins1portkey1rust1sonnet1ssrf1typesafe1vercel1zdi1
26 stories, newest first · one card per story
Stories tagged #ai-gateway
Respan launches open-source Rust AI gateway built from plugins
The pre-alpha gateway, under MIT or Apache-2.0, lets teams add providers and features without changing a small core.
1
Jev is Vercel’s fastest-adopted AI model ever
Vercel says Typesafe AI’s Jev reached 35% of paid teams in two weeks, its fastest model adoption.
9 Best AI Gateways in 2026: Bifrost, Portkey, LiteLLM, Kong and 5 More Ranked
MarkTechPost ranks nine 2026 AI gateways, placing self-hosted Bifrost first and noting Portkey's Palo Alto deal.
9
CVE-2026-90970: GitLab AI Gateway RCE
GitLab patched CVE-2026-90970, a critical authenticated RCE in the self-hosted AI Gateway for Duo users.
CVE-2026-90970: Critical GitLab AI Gateway Flaw Fixed
GitLab patched CVE-2026-90970, letting authenticated Duo users execute commands on self-hosted AI Gateways.
3
Critical GitLab AI Gateway Flaw Lets Attackers Execute Arbitrary Commands
GitLab patched CVE-2026-90970, a CVSS 9.9 bug letting authenticated users execute commands on self-hosted AI Gateway.
4
Critical GitLab AI Gateway Vulnerability Enables Remote Code Execution Attacks
GitLab patched CVE-2026-90970, a CVSS 9.9 flaw letting authenticated Duo users execute commands on self-hosted AI Gateways.
3
GitLab security advisory (AV26-994)
Canadian Cyber Centre advisory urges administrators to patch GitLab AI Gateway flaws fixed in versions 19.2.4, 19.3.2, and 19.4.1.
GitLab Patches Critical 9.9 AI Gateway Flaw Allowing Command Execution on Self-Hosted Servers
GitLab patched CVE-2026-90970, a CVSS 9.9 command-execution flaw in self-hosted AI Gateway.
4
GitLab warns of critical RCE vulnerability in AI Gateway service
GitLab urges immediate patches for critical AI Gateway RCE CVE-2026-90970 on self-hosted instances.
9
Introducing Web Search API via AI Gateway
Cloudflare added a Web Search API to AI Gateway with Ceramic.ai, Exa, and Linkup for live agent grounding.
7
Building for good: How civil society organizations are automating on Cloudflare
Cloudflare gave 30 nonprofits more than $7.5 million in credits to build secure AI automation.
3
Cloudflare OS: your company’s agent workspace, managed for you
Cloudflare opened a waitlist for managed Cloudflare OS agent workspaces with GitHub and Google Workspace support.
3
Cut your AI spend with AI Gateway's Auto Router
Cloudflare’s AI Gateway Auto Router beta sends each request to a cheaper model that can still do the task.
9
Monetization Gateway beta: charge AI agents for consumption with HTTP 402
Cloudflare opened a closed beta of Monetization Gateway so sites can charge AI agents per request via HTTP 402.
4
Critical Bifrost AI Gateway Flaw Lets Attackers Run Commands Without Credentials
Unauthenticated Bifrost flaw CVE-2026-90898 lets attackers run commands and steal provider API keys.
3
Top 5 AI Gateways for Enterprise (2026 Guide)
A 2026 buyer's guide ranks NeuralTrust TrustGate, Kong AI Gateway, and Cloudflare AI Gateway as top enterprise AI gateways for security and governance.
5
Hackers Can Turn Vulnerable LiteLLM AI Gateways Into Root Access and Cloud Credential Theft
Wiz found multiple LiteLLM AI gateway flaws, including a CVE-2026-59822 MCP auth bypass added to CISA KEV, enabling root code execution and cloud credential theft.
4
LiteLLM Flaws Let Attackers Execute Code as Root and Steal Cloud Credentials
Wiz disclosed LiteLLM flaws including CVE-2026-59822 MCP auth bypass, now in CISA KEV, enabling root RCE and AWS credential theft from exposed gateways.
4
Nearly 1 in 10 Exposed LiteLLM Gateways Accepted the Example "sk-1234" Admin Key
Wiz found 294 of 3,074 internet-facing LiteLLM gateways accepted the documented default admin key sk-1234, exposing provider API keys and cloud IAM credentials.
3
New infosec products of the month: August 2026
August 2026 roundup of security product releases from ServiceNow, Tanium, Snyk, F5, A10, Searchlight Cyber, Intezer, NETSCOUT, Tufin, and Abnormal AI.
2
F5 enhances AI Gateway to control AI costs, access, and security
F5 integrated AI Gateway into its AI Security Platform, adding model routing, MCP governance, and guardrails, claiming up to 60% token spend reduction.
3
LiteLLM Supply-Chain Attack - Technology, Banking and Healthcare the Most Affected
TeamPCP planted the SANDCLOCK credential stealer in LiteLLM PyPI releases, exposing credentials across 2,038 repositories at 898 organizations including Microsoft and NVIDIA.
1