Reported by 5 outlets
Threat Actors Target Exposed AI Infrastructure for API Key Theft and Cryptomining
Why this score
- Breadth
- 2.00 / 2.0 · 5 sources
- Authority
- 1.00 / 2.0 · best outlet weight
- Severity
- 4.90 / 5.0 · CVSS + KEV signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.00 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Desk analysis
Wiz Threat Research ran honeypots impersonating LiteLLM, Flowise, LangChain, Langflow, ChromaDB, and Ollama for 90 days and recorded sustained exploitation of internet-facing AI infrastructure, with tooling tailored to each platform's internals. Against LiteLLM, attackers used CVE-2026-59822, an MCP authentication bypass in which a failed token check returns an empty UserAPIKeyAuth() object, so a single character Bearer token such as x grants full MCP access; the honeypots caught probes of model enumeration with GET /v1/models and Authorization: Bearer x. They also exploited CVE-2026-42271, command injection in the /mcp-rest/test/connection and /mcp-rest/test/tools/list preview endpoints, where the stdio command field reaches subprocess execution with no role check. The observed payload pulled a Monero miner from 185.62.1[.]8 into /tmp/.dbus-cache, launched the gmon binary detached, deleted the staging directory, and returned a valid MCP handshake so the connection test looked legitimate. CVE-2026-42271 also chains with CVE-2026-48710, a Starlette host header validation bypass, for fully unauthenticated RCE, and external researchers have linked that chain to the Qilin ransomware group.
A LiteLLM proxy is a credential chokepoint rather than an ordinary web app: it can hold API keys for OpenAI, Anthropic, Azure, and Gemini, run with cloud IAM permissions, and front MCP connections into databases, code repositories, Slack, and internal APIs. Wiz observed attackers reading the proxy master key out of Python module memory because it never exists on disk, fingerprinting backend models to choose between key theft and inference-quota abuse, and hiding miners as /usr/src/node-red/xmrig or a unicorn binary under /app/data/.claude/, where it blends with Claude Code artifacts. The exposure base is not niche: Wiz's State of AI in the Cloud 2026 report puts self-hosted AI software in 90 percent of cloud environments and self-hosted models in 63 percent. What the event list does not spell out is the timeline: NVD published CVE-2026-42271 on May 8, 2026, CISA KEV added it on June 8, 2026 with a June 22 federal remediation deadline, and the CVE-2026-59822 advisory landed on June 30, 2026. This late August story is therefore not a new bug but confirmation that months-old, already-patched flaws are still being worked in the wild, which makes the risk hygiene-driven rather than disclosure-driven, and it means a file-based IoC sweep will miss a miner whose binary was deleted at launch.
Patch LiteLLM to 1.84.0 or later, which covers both flaws: 1.83.7 fixed CVE-2026-42271 and 1.84.0 fixed CVE-2026-59822. Red Hat OpenShift AI bundles the vulnerable proxy and needs the fixed 2.25.8, 3.3.4, or current 3.4 builds. Where an immediate upgrade is impossible, block /mcp/ and the /mcp-rest/test/ endpoints at the reverse proxy, put authenticated AI services behind the same network controls as production cloud infrastructure, and treat any unauthenticated AI service reachable from the internet as already compromised. Concrete hunts: GET /v1/models requests carrying Authorization: Bearer x, python3 children spawned by the LiteLLM process, reads of /app/litellm_config.yaml, /etc/litellm/.env, and ~/.litellm/config.yaml, files at /tmp/.dbus-cache/gmon and /usr/src/node-red/xmrig, and DNS or egress to 185.62.1[.]8, 185.84.98[.]85, pool.hashvault[.]pro, or OAST-style callback domains. Verify the master key is not the default sk-1234 and rotate any provider keys an exposed proxy could have served.
Watch for CISA adding CVE-2026-59822 to KEV, which would put federal remediation deadlines on the authentication bypass the way June 8 did for the command injection. Watch also whether the Qilin-linked CVE-2026-42271 plus CVE-2026-48710 chain graduates from miners and credential theft to actual ransomware deployment, since unauthenticated RCE on a credential chokepoint is exactly the entry a ransomware operator pays for.
Timeline
-
original reporting
Hackers Are Targeting AI Servers to Steal API Keys and Install Crypto Miners
cyberpress.org · 46d ago · August 28th, 2026
Threat actors are increasingly targeting exposed AI infrastructure to steal model-provider API keys , abuse cloud-connected services, and deploy Monero cryptominers, according to new research from Wiz Threat Research. Wiz monitored honeypots designed to imitate commonly deployed AI and machine-learning services for 90 days, including LiteLLM, Flowise, LangChain, Langflow, ChromaDB, Ollama, and other platforms. The researchers found attackers adapting their tools and post-exploitation activity to the internals of individual AI services. The activity shows that AI infrastructure is becoming a valuable cloud attack surface. These platforms often hold high-value credentials, connect to internal tools, process untrusted input, and may have permissions to access cloud services. A compromised AI proxy can potentially expose keys for providers such as OpenAI, Anthropic, Azure, and Gemini. Hackers Raid AI Servers The first attack pattern involved exposed Model Context Protocol (MCP) servers. MCP allows AI agents to communicate with databases, code repositories, internal APIs, Slack, and other external tools. Wiz observed exploitation attempts against LiteLLM’s MCP components . One issue, tracked as CVE-2026-59822, allowed an authentication bypass caused by faulty OAuth2 header handling. Attackers used a minimal Bearer token, such as x , to probe model-enumeration endpoints. Hackers Raid AI Servers (Source: wiz) A second flaw, CVE-2026-42271, affected LiteLLM MCP server test endpoints.
-
update from nvd.nist.gov
CVE-2026-42271 Detail (NVD entry)
nvd.nist.gov · 159d ago · May 8th, 2026
NVD published the CVE-2026-42271 record on May 8, 2026: LiteLLM versions 1.74.2 through before 1.83.7 let any authenticated user, including holders of low-privilege internal-user keys, run arbitrary commands on the proxy host via the POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list endpoints, which pass the stdio command field to subprocess execution with no role check. GitHub rates it CVSS-B 8.7 High, CWE-77 and CWE-78, patched in 1.83.7. NVD also lists Red Hat OpenShift AI 2.25 before 2.25.8 and 3.3 before 3.3.4 as affected, with Red Hat errata referencing the CVE.
-
update from cisa.gov
BerriAI LiteLLM Command Injection Vulnerability (CISA KEV entry)
cisa.gov · 128d ago · June 8th, 2026
CISA added the BerriAI LiteLLM Command Injection Vulnerability, CVE-2026-42271, to the Known Exploited Vulnerabilities Catalog on June 8, 2026, with a federal remediation due date of June 22, 2026 under BOD 22-01. The KEV listing documents confirmed in-the-wild exploitation roughly eleven weeks before the Wiz honeypot research reached the news coverage in this story.
-
update from github.com
GHSA-7488-6r32-c95q: MCP Authentication Bypass via OAuth2 Passthrough Fallback
github.com · 106d ago · June 30th, 2026
BerriAI published GHSA-7488-6r32-c95q for CVE-2026-59822 on June 30, 2026, credited to GitHub user yaaras. A failed LiteLLM key validation falls back to an empty UserAPIKeyAuth() object, letting a fabricated Authorization header with any Bearer token, even a single character, establish an authenticated MCP session and reach configured MCP tooling. CVSS v4 is 8.8 High, all versions below 1.84.0 are affected, the fix is 1.84.0, and the stated workaround is disabling MCP routes or blocking /mcp/ at the reverse proxy or API gateway.
-
update from wiz.io
Inside 90 days of attacks on AI infrastructure (Wiz Threat Research)
wiz.io · 48d ago · August 27th, 2026
Wiz Threat Research published the underlying advisory on August 27, 2026, one day ahead of the cyberpress.org coverage in this story. It documents 90 days of honeypot telemetry across LiteLLM, Flowise, LangChain, Langflow, ChromaDB, and Ollama, including exploitation of CVE-2026-59822 and CVE-2026-42271, master key extraction from Python module memory, XMRig staging at /usr/src/node-red/xmrig, a miner hidden as unicorn under /app/data/.claude/ on the Langflow honeypot, and an external researcher link between the Qilin ransomware group and a CVE-2026-42271 plus CVE-2026-48710 Starlette host header chain. The full IoC set adds pool.hashvault[.]pro, crazyeltonproxy[.]top, 94.26.106[.]29, and 1710.rwlp.be to the two IPs the news story carries, plus default master key sk-1234 abuse and a State of AI in the Cloud finding that 90 percent of cloud environments run self-hosted AI software.