Apple AI tools can leak passwords and run code
Attackers are breaking into AI infrastructure like LiteLLM, an open-source tool that companies use to route requests to AI models, and hijacking it to run their own code and steal credentials. In one flaw attackers just fake a login header to sneak requests past LiteLLM's security, and in another they send a hidden command that LiteLLM runs automatically to install a cryptocurrency miner.
- Report priority
- Medium
- Fix
- Fixed in 1.83.7.labs
- Targets
- LiteLLM+4 more
How it works
Attackers send a forged authorization header that tricks LiteLLM's login fallback into letting requests through without a real key, then send a fake AI tool setup that includes a hidden command, which LiteLLM runs by itself while testing the connection.
What to do
Check whether your LiteLLM installation is version 1.74.2 through 1.83.6, and whether your LiteLLM proxy, MCP endpoints, or agent platforms like LangChain, Flowise, OpenWebUI, or Node-RED are reachable from the open internet.
Run this in the application environment you want to check:
pip show litellmUpdate LiteLLM to version 1.83.7 or later, and restrict network access to LiteLLM's MCP endpoints and any agent platforms so they are not exposed publicly.
Technical details
Affected software: LiteLLM, LangChain, Flowise, OpenWebUI, Node-RED
An attacker connects to an exposed LiteLLM server and sends it a tool configuration containing a command instead of a normal setting. LiteLLM runs that command to test the connection, launching a cryptocurrency miner in a hidden temporary folder. The miner then runs in the background while LiteLLM sends back a normal-looking response so the intrusion is not obvious.
CVE-2026-59822 lets a forged Authorization header trigger a faulty OAuth2 fallback path, letting requests reach LiteLLM's MCP tooling without a valid API key. CVE-2026-42271 is a command-injection flaw in LiteLLM's MCP preview endpoint, which accepts a configuration containing a command field and executes it during connection testing; it affects versions 1.74.2 through 1.83.6, is fixed in 1.83.7, and is in CISA's Known Exploited Vulnerabilities catalog. Researchers have also chained it with CVE-2026-48710, a Starlette host-header validation bypass, to turn it into an unauthenticated exploit. Separately, attackers use blind prompt injection against LangChain, Flowise, OpenWebUI, and Node-RED, coercing shell-capable agents into making DNS callbacks to attacker domains to confirm code execution, then fetching Base64-encoded follow-on commands and deploying XMRig miners.