Lumen's Black Lotus Labs says the PoeLLM cryptomining botnet has compromised more than 2,100 servers, many running exposed LiteLLM or Ollama. Each host it takes then mines and scans for the next, so an AI server left open to the internet is attack surface to lock down.
Perspective Coverage
6 publishers
- Builder
- Builder 34%
- Operator
- Operator 59%
- Investor
- Investor 7%
Reality
- Evidence70
- Adoption50
- Hype gap+5
- Incentives
- Not scored
- Confidence70
SonicWall's CVSS 10.0 SSRF chains into command execution on remote access appliances, and JFrog Artifactory hands unauthenticated attackers admin under default configuration. Reverse shells and miners are already landing.
Perspective Coverage
4 publishers
- Builder
- Builder 14%
- Operator
- Operator 72%
- Investor
- Investor 14%
Reality
- Evidence70
- Adoption
- Not scored
- Hype gap+10
- Incentives35
- Confidence68
buildOne report1 publisher A low-privilege LiteLLM key could run system commands through its MCP test endpoints
LiteLLM's MCP test endpoints let any valid proxy key run arbitrary commands on the gateway, rated CVSS 8.8. CISA added the flaw to its Known Exploited Vulnerabilities catalog on June 8, 2026, confirming exploitation in the wild.
Reality
- Evidence50
- Adoption
- Not scored
- Hype gap+10
- Incentives
- Not scored
- Confidence50
buildOne report1 publisher One slash in a Host header moves the path Starlette's middleware checks
CVE-2026-48710 is in CISA's Known Exploited Vulnerabilities catalog, scored 6.5 by Starlette's maintainers and 10.0 by Horizon3.ai once chained with a LiteLLM command injection. Version 1.0.1 is the fix.
Reality
- Evidence45
- Adoption55
- Hype gap+12
- Incentives65
- Confidence50
buildOne report1 publisher A query string smuggled into the Host header makes Starlette skip authentication
X41 D-Sec's proof of concept for CVE-2026-48710 is one unauthenticated GET whose Host header carries /public?bar=. Starlette sits underneath LiteLLM, vLLM and MCP servers, so the work starts with a dependency query.
Reality
- Evidence56
- Adoption
- Not scored
- Hype gap+18
- Incentives55
- Confidence52
buildOne report1 publisher An exposed LiteLLM gateway hands over every key in PID 1's environment
Microsoft Security Research says intruders who reached exposed LiteLLM, RAGFlow and Kestra deployments went for provider keys and database URLs first. It can name a confident initial vector in only one of the three cases.
Reality
- Evidence45
- Adoption30
- Hype gap+10
- Incentives55
- Confidence42
Attackers hid a cryptominer inside a LiteLLM MCP config test that reported success
Ninety days of Wiz honeypot telemetry shows tooling written for LiteLLM's internals, including a config test endpoint that spawns whatever command it is handed and a miner whose output comes home inside the MCP protocol.
Reality
- Evidence62
- Adoption66
- Hype gap+12
- Incentives72
- Confidence55
Microsoft's own incident data says the AI gateway is now the credential store
Three Microsoft investigations into AI middleware ended in stolen keys, persistence and compute abuse. The remediation list is ordinary infrastructure hygiene, applied to plumbing nobody inventoried.
Reality
- Evidence66
- Adoption42
- Hype gap+12
- Incentives68
- Confidence52