CVE-2026-48710

The PoeLLM malware is a cryptomining campaign targeting exposed AI servers, particularly those running LiteLLM, Ollama, Gotenberg, and Gitea. It uses an ELF file named libgcrypt that retrieves command-and-control (C2) addresses by extracting keywords from a poem hosted on GitHub, which are then mapped to IPv4 addresses via a hardcoded dictionary. The malware enables remote shell access, deploys XMRig and Iron cryptocurrency miners, and turns infected servers into scanners to propagate further, exploiting CVE-2026-42271 and potentially chaining it with CVE-2026-48710 for unauthenticated RCE. Over 3,400 servers have been compromised, primarily in the US and Western Europe, with C2 infrastructure showing signs of Italian origin.

Wiz Research identified that nearly 1 in 10 internet-facing LiteLLM gateways accepted the default example admin key 'sk-1234', exposing critical cloud IAM credentials and API keys. Attackers with access to the master key can read all model provider API keys, execute code via misconfigured endpoints, and exploit pass-through routing to harvest cloud instance metadata. Multiple CVEs have been documented, including authentication bypasses and post-authentication code execution flaws, some of which are already being exploited in the wild to deploy cryptocurrency miners and extract sensitive data. Despite patches, many deployments remain vulnerable due to misconfigurations and unrotated default keys.

CISA has added seven actively exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, including critical flaws in SonicWall SMA 1000, Sangoma Switchvox, JFrog Artifactory, Kludex Starlette, Kestra OSS, and Berri LiteLLM. Threat actors are exploiting these vulnerabilities to deploy reverse shells, execute arbitrary code, steal credentials, and deploy cryptocurrency miners. Exploitation of CVE-2026-83548 and CVE-2026-83549 in SonicWall devices has been confirmed, while CVE-2026-9586 and CVE-2026-82329 are being used to gain administrative access and conduct post-exploitation activities. Microsoft and Wiz report active exploitation of CVE-2026-42271 and CVE-2026-48710 in LiteLLM deployments, with attackers achieving remote code execution and stealing API keys, and CVE-2026-49869 in Kestra being used to establish reverse shells and deploy miners.

Wiz Threat Research observed 90 days of sustained attacks against AI infrastructure through honeypots deployed across services like LiteLLM, Flowise, and LangChain. Attackers exploited vulnerabilities in MCP servers, including authentication bypass and command injection (CVE-2026-59822, CVE-2026-42271), to achieve remote code execution and deploy cryptominers. A second pattern involved blind prompt injection against AI agent frameworks, where attackers used out-of-band DNS callbacks to confirm execution and later fetch payloads from Pastebin. Post-exploitation activity was tailored to AI environments, including in-memory extraction of LiteLLM master keys, model enumeration, and use of environment-specific camouflage to hide malicious binaries.