Wiz Recorded Attacks on LiteLLM and Other Publicly Accessible AI Services
Wiz honeypot telemetry showed persistent attempts to exploit AI and MCP services. Researchers also recorded attacks targeting two LiteLLM vulnerabilities for which fixes are available.
On August 27, 2026, Wiz said its 90-day honeypot monitoring detected persistent attack activity against publicly accessible AI infrastructure. The observed targets included LiteLLM MCP vulnerabilities, specifically two flaws that attackers, according to the telemetry, were exploiting or attempting to exploit. The findings concern decoy systems operated by Wiz, not confirmed compromises of specific production organizations.
The honeypots captured activity targeting AI infrastructure services and components. Wiz recorded activity aimed at LiteLLM, LangChain, Flowise, Langflow, ChromaDB, and Ollama. After successful intrusions, researchers observed cryptocurrency miners being deployed, as well as attempts to obtain AI provider keys from the decoy environments.
LiteLLM MCP vulnerabilities have available fixes
The first detected flaw is CVE-2026-42271. It affects LiteLLM test MCP endpoints and allowed command execution. The BerriAI security advisory lists a fix in LiteLLM version 1.83.7. If an update is not immediately possible, the vendor recommends blocking the /mcp-rest/test/connection and /mcp-rest/test/tools/list endpoints.
The second flaw is CVE-2026-59822, an authentication bypass vulnerability in LiteLLM MCP. A fix is available in version 1.84.0. As a temporary measure, MCP paths are recommended to be disabled or blocked at the reverse proxy.
For operators, it is important that the updates address different flaws. Deploying only version 1.83.7 therefore does not cover CVE-2026-59822, which requires version 1.84.0. Operators of publicly accessible instances should verify the version in use and the availability of the listed test and MCP paths.
Why AI gateways and MCP services are attractive targets
AI proxies, gateways, and servers implementing the Model Context Protocol (MCP) can connect models with external tools, internal services, and APIs. They therefore often handle credentials for model APIs or permissions for other systems. A compromise of a publicly exposed and unsecured service may consequently extend beyond a single AI workload.
In its telemetry, Wiz described attackers’ attempts to expand access after entering the decoy environment. In addition to cryptocurrency mining, this involved searching for AI provider keys. However, the fact that these were honeypots means the observations cannot automatically be applied to all real-world deployments or used to determine the number of affected organizations.
Observation limits and next steps
Wiz did not capture the original payload text during prompt injection; it reconstructed the natural-language content from observed behavior. Researchers also reported a possible connection between the CVE-2026-42271 and CVE-2026-48710 chain and the Qilin group, but this attribution was not independently verified in the available primary sources.
The most practical step for LiteLLM administrators is to update to releases fixing both vulnerabilities, or immediately restrict the risky MCP endpoints. Going forward, it will be important to monitor whether Wiz or other trusted research teams provide evidence of impact on production environments, as well as new indicators of compromise targeting additional AI frameworks.
Sources
- Wiz Threat Research – Describes 90-day honeypot telemetry, recorded techniques, indicators of compromise, and the limitations of the findings.
- BerriAI LiteLLM security advisory GHSA-v4p8-mg3p-g94g – Confirms the scope of CVE-2026-42271, the fix in version 1.83.7, and temporary blocking of two MCP test endpoints.
- GitHub Advisory Database GHSA-7488-6r32-c95q – Confirms CVE-2026-59822, the fix in version 1.84.0, and the recommended restriction of MCP paths.
Verified and updated: 08/30/2026 15:36
