Qilin-Linked Campaign Exploits MCP Gateway and LLM Framework Flaws (CVE-2026-59822, CVE-2026-42271, CVE-2026-48710) for RCE and Cryptomining

Qilin-Linked Campaign Exploits MCP Gateway and LLM Framework (TL-2026-2185) is a critical-severity software vulnerability scored CVSS 10, first published 2026-08-28 and last reviewed 2026-08-31. It is attributed to Qilin ransomware group with low confidence, affects BerriAI LiteLLM, references 3 CVEs (CVE-2026-59822, CVE-2026-42271, CVE-2026-48710), maps to 15 MITRE ATT&CK / ATLAS techniques (AML.T0051, T1005, T1027), and is covered by 9 detection rules and 24 indicators of compromise.

Key facts for TL-2026-2185

Threat ID
TL-2026-2185
Severity
CRITICAL
CVSS
10
Status
ACTIVE
Category
VULNERABILITY
First published
2026-08-28
Last reviewed
2026-08-31
Attribution
Qilin ransomware group
Attribution confidence
LOW
Motivation
FINANCIAL
Target sectors
technology, cross-sector
Target regions
global
Detection rules
9
Indicators of compromise
24
Updates
2026-08-31 · revalidated 1× · latest source

Malware and tooling in Qilin-Linked Campaign Exploits MCP Gateway and LLM Framework

Malware and tooling: Agenda Ransomware, AgendaCrypt, xmrig

Wiz.io honeypots logged 90 days of active exploitation against AI infrastructure — LiteLLM/MCP gateways, LangChain, Flowise, Langflow, OpenWebUI, and Node-RED — chaining an MCP auth bypass (CVE-2026-59822), an MCP test-endpoint command injection (CVE-2026-42271), and a Starlette Host-header bypass (CVE-2026-48710, "BadHost") into unauthenticated RCE. External researchers linked the chain to the Qilin ransomware group; successful compromises deployed the XMRig Monero miner rather than ransomware.

How Qilin-Linked Campaign Exploits MCP Gateway and LLM Framework works

Wiz Threat Research deployed honeypots mimicking commonly-run AI/ML services (LiteLLM, Flowise, LangChain, Langflow, ChromaDB, Ollama, and others) and observed 90 days of sustained scanning and exploitation. Three distinct vulnerabilities converged into a single attack surface. CVE-2026-59822 is an authentication-bypass flaw in LiteLLM's MCP Streamable HTTP endpoint: when OAuth2-passthrough token validation failed, the handler fell back to an empty UserAPIKeyAuth() object instead of rejecting the request, so any Bearer token — even a single character such as 'x' — granted full MCP tool access. CVE-2026-42271 is a command-injection flaw in two MCP preview/test endpoints, POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list, which accept a full stdio server configuration (command/args/env) and spawn it as a subprocess on the proxy host; originally this required a valid (even low-privilege) API key. CVE-2026-48710 ("BadHost") is a Host-header validation bypass in the Starlette ASGI framework underlying FastAPI, LiteLLM, and much of the Python AI-agent ecosystem: Starlette reconstructed request.url by concatenating the raw, unvalidated Host header with the request path, letting a crafted Host header (e.g. a path-separator character appended) desync what security middleware sees from what the router actually dispatches. Chaining CVE-2026-48710 in front of CVE-2026-42271 removes the authentication requirement entirely, producing fully unauthenticated remote code execution against any network-reachable, unpatched LiteLLM/MCP deployment — a chain researchers rated a combined CVSS of 10.0. In observed honeypot sessions, attackers submitted fake MCP stdio configs whose 'command' field was a Python script that downloaded a cryptominer archive from http://185.62.1.8/mon/mon.zip, extracted it to the hidden directory /tmp/.dbus-cache/, launched the 'gmon' Monero-miner binary detached via start_new_session=True, returned a fabricated-but-valid-looking MCP handshake to mask the compromise, and then deleted the staging directory while the miner persisted in memory. Separately, attackers ran blind/indirect prompt injection against LangChain, Flowise, OpenWebUI, and Node-RED agent deployments — instructing the model to invoke its shell tool — and confirmed successful execution out-of-band via DNS lookups to attacker-controlled OAST-style domains embedding the victim IP/session ID, avoiding any HTTP response that would reveal success. Once confirmed, second-stage commands were pulled from Pastebin (keeping payload content out of logs and allowing dynamic updates) and delivered base64-encoded (echo <b64>|base64 -d|bash -i) to evade naive log-based detection. On compromised Node-RED hosts the XMRig binary was staged at /usr/src/node-red/xmrig to blend into the Node.js process tree; on Langflow hosts it was staged as a binary named 'unicorn' inside /app/data/.claude/, mimicking a Claude Code configuration directory. Rather than hunting for credential files on disk, attackers extracted the LiteLLM master key and API keys directly from the live Python process's module state (e.g. reading litellm.proxy.proxy_server.master_key in memory), and fingerprinted deployments using LiteLLM's known default master key 'sk-1234'. External researchers linked the exploitation chain to the Qilin (aka Agenda) ransomware-as-a-service group, though this attribution is circumstantial: the observed honeypot payload was exclusively XMRig cryptomining, not ransomware deployment, and no primary source in this research confirmed the link beyond 'external researchers.' CVE-2026-42271 was added to the CISA Known Exploited Vulnerabilities catalog on 2026-06-08 based on confirmed in-the-wild exploitation.

MITRE ATT&CK / ATLAS techniques used in TL-2026-2185

Execution

AML.T0051 LLM Prompt Injection; T1059.004 Unix Shell; T1059.006 Python

Collection

T1005 Data from Local System

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1140 Deobfuscate/Decode Files or Information; T1564.001 Hidden Files and Directories

Command and Control

T1071.004 DNS; T1105 Ingress Tool Transfer

Initial Access

T1190 Exploit Public-Facing Application

Impact

T1496 Resource Hijacking

Credential Access

T1552 Unsecured Credentials

Resource Development

T1584 Compromise Infrastructure; T1588.002 Tool

Affected products and versions in Qilin-Linked Campaign Exploits MCP Gateway and LLM Framework

  • BerriAI — LiteLLM
    Vulnerable versions: < 1.84.0 (CVE-2026-59822); 1.74.2 - 1.83.6 (CVE-2026-42271)
    Fixed in: 1.84.0+; 1.83.7+
  • Encode / Kludex — Starlette
    Vulnerable versions: 0.8.3 - 1.0.0
    Fixed in: 1.0.1+
  • LangChain — LangChain
    Vulnerable versions: targeted via blind prompt injection against agent tool-use, not a distinct CVE
  • FlowiseAI — Flowise
    Vulnerable versions: targeted via blind prompt injection against agent tool-use, not a distinct CVE
  • Langflow — Langflow
    Vulnerable versions: targeted for cryptominer/dropper staging via compromised agent execution, not a distinct CVE
  • Open WebUI — OpenWebUI
    Vulnerable versions: targeted via blind prompt injection against agent tool-use, not a distinct CVE
  • Node-RED — Node-RED
    Vulnerable versions: targeted via blind prompt injection against agent tool-use, not a distinct CVE

Remediation for Qilin-Linked Campaign Exploits MCP Gateway and LLM Framework

Patches

  • LiteLLM 1.83.7 (CVE-2026-42271, released 2026-05-08)
  • LiteLLM 1.84.0 (CVE-2026-59822)
  • Starlette 1.0.1 (CVE-2026-48710)

Immediate actions

  • Upgrade LiteLLM to >=1.84.0 (patches CVE-2026-59822) and confirm >=1.83.7 baseline (patches CVE-2026-42271)
  • Upgrade the Starlette dependency to >=1.0.1 (patches CVE-2026-48710 / BadHost) across every service that embeds it (FastAPI, LiteLLM, MCP servers)
  • Block or disable the /mcp-rest/test/connection and /mcp-rest/test/tools/list endpoints until patched
  • Block outbound/inbound access to 185.62.1.8, 185.84.98.85, 94.26.106.29, pool.hashvault.pro, crazyeltonproxy.top, and 1710.rwlp.be at the network perimeter
  • Rotate any LiteLLM master keys and upstream model-provider API keys that may have been exposed via in-memory extraction

Workarounds

  • Restrict MCP test endpoints to the PROXY_ADMIN role or disable them entirely
  • Block or filter access to /mcp/ routes at the reverse proxy or API gateway
  • Validate/normalize Host headers at a front-end proxy ahead of any Starlette-based service that has not yet upgraded

Longer-term hardening

  • Inventory all AI/LLM infrastructure (LiteLLM, MCP gateways, LangChain, Flowise, Langflow, OpenWebUI, Node-RED) as production assets with named owners and monitoring
  • Require authentication by default on all MCP and AI-gateway endpoints rather than treating it as optional
  • Scope IAM/cloud permissions narrowly for AI proxies to limit blast radius from a single compromised service
  • Deploy runtime behavioral monitoring (unexpected child-process / process-ancestry detection) around AI service containers
  • Treat prompt injection as an untrusted-input code-execution surface — sandbox or restrict shell/tool access for agent frameworks that process external content

CVEs associated with Qilin-Linked Campaign Exploits MCP Gateway and LLM Framework

CVE-2026-59822, CVE-2026-42271, CVE-2026-48710

Weaknesses (CWE) in Qilin-Linked Campaign Exploits MCP Gateway and LLM Framework

CWE-287, CWE-306, CWE-77, CWE-78, CWE-444, CWE-1289

Timeline of Qilin-Linked Campaign Exploits MCP Gateway and LLM Framework

  • X41 D-Sec discovers the Starlette 'BadHost' Host-header validation bypass (later CVE-2026-48710) during an OSTIF/Alpha-Omega-funded security audit of vLLM.
  • Starlette maintainers are notified of the BadHost issue with a working proof of concept and acknowledge the report the next day.
  • CVE-2026-42271 (LiteLLM MCP test-endpoint command injection) is publicly disclosed.
  • LiteLLM 1.83.7 is released, restricting the MCP test endpoints to the PROXY_ADMIN role and patching CVE-2026-42271.
  • Starlette releases v1.0.1, validating the Host header and remediating the BadHost flaw (CVE-2026-48710).
  • CVE-2026-48710 ("BadHost"), a Starlette Host-header authentication-bypass vulnerability affecting versions 0.8.3-1.0.0, is publicly disclosed.
  • Horizon3.ai validates that CVE-2026-42271 chained with CVE-2026-48710 produces fully unauthenticated RCE against LiteLLM/MCP deployments, rated a combined CVSS of 10.0.
  • CISA adds CVE-2026-42271 to the Known Exploited Vulnerabilities catalog, citing confirmed active exploitation in the wild.
  • CISA KEV remediation due date for CVE-2026-42271 under Binding Operational Directive requirements for federal civilian agencies.
  • CVE-2026-59822 (LiteLLM MCP OAuth2-passthrough authentication bypass) is documented and fixed in LiteLLM 1.84.0.
  • Wiz.io publishes 90-day honeypot telemetry findings covering MCP/LiteLLM exploitation, blind prompt injection, XMRig cryptominer deployment, and IOCs; external researchers link the exploitation chain to the Qilin ransomware group.
  • Cyber Security News reports on the Wiz.io findings, publicizing the CVE chain, Qilin attribution, and XMRig IOCs.

Update history for TL-2026-2185

Sources cited for Qilin-Linked Campaign Exploits MCP Gateway and LLM Framework

More in vulnerability

Detection coverage for TL-2026-2185

As of 2026-08-31, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2185 across Splunk SPL, Microsoft KQL and Sigma, covering 24 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats