Authentication that turns on how a path is read gets decided twice: once by whatever terminates TLS in front of the service, and once by the application's own router. CISA describes the three software entries as a single attack path, starting with a crafted request to a public LiteLLM instance, to a service using Starlette, or to Kestra [5], and defeating bearer token validation, URL path interpretation, or suffix checks for `/configs` [6]. What follows the bypass is Model Context Protocol tool use, protected operations, or arbitrary workflow creation [7]. In Kestra, it is script execution plugins running code with root privileges [8].
Seven entries map onto six products, so at least one product contributes two of them [24], and the dev.to summary of the catalog entry ties those flaw classes to the three products as a group rather than one by one [6]. If you need to know which CVE describes the version you run, the advisories listed alongside the entry are where the mapping lives: GHSA-7488-6r32-c95q for LiteLLM, GHSA-86qp-5c8j-p5mr for Starlette, GHSA-5vc5-wxxq-3fjx for Kestra [18].
The window is shorter than the calendar suggests. From the 2 September entry [1] to the 5 September deadline [3] is three days [21], and 5 September 2026 is a Saturday, which leaves Thursday and Friday as the only full working days inside it [22].
CISA's mitigation list asks for the patched version plus external exposure moved behind a VPN, an allowlist or an authentication proxy, and then for restrictions on shell and script launches, token creation and outbound communication from management planes [16]. For a workflow engine, that second half constrains the feature you deployed the thing for. The version of it that survives contact with production is a non-root service account and an egress policy, not a ban on script plugins.
A model gateway holds provider keys and holds tool wiring, and the listed impacts pair those two: theft or tampering with API keys, administrator tokens, configurations and artifacts, then lateral movement into internal networks, cloud environments and delivery pipelines [19].
Whether Saturday is an incident date or a maintenance ticket depends on the three conditions the write-up states: the vulnerable version is reachable, the patch is not applied, and nothing else blocks management operations or code execution after a bypass [15]. Most of the seven need no user interaction [14], so there is no user report to wait for. On Switchvox, the SQL produced by concatenating `PhoneIP` into a PostgreSQL statement and abusing `PROGRAM` lands in `db-quirks.log` [9][17], a filename that is about to teach someone a lesson about naming. Elsewhere the signal is shells or unexpected child processes under Java, Python, PostgreSQL or VPN appliance parents [17].
One of these entries is a product you chose, and one is a framework something of yours imports: CISA's phrasing for the second target is "a service using Starlette" [5]. Four of the six named products carry the dated deadline, and the two AI-stack libraries do not [23], which makes that half of the work self-scheduled. If producing the list of services that import Starlette, and the routes your gateway answers on a public address, takes longer than an afternoon, then three days was never the binding number.
