Lumen's Black Lotus Labs says the PoeLLM cryptomining botnet has compromised more than 2,100 servers, many running exposed LiteLLM or Ollama. Each host it takes then mines and scans for the next, so an AI server left open to the internet is attack surface to lock down.
Perspective Coverage
6 publishers
- Builder
- Builder 34%
- Operator
- Operator 59%
- Investor
- Investor 7%
Reality
- Evidence70
- Adoption50
- Hype gap+5
- Incentives
- Insufficient
- Confidence70
SonicWall's CVSS 10.0 SSRF chains into command execution on remote access appliances, and JFrog Artifactory hands unauthenticated attackers admin under default configuration. Reverse shells and miners are already landing.
Perspective Coverage
4 publishers
- Builder
- Builder 14%
- Operator
- Operator 72%
- Investor
- Investor 14%
Reality
- Evidence70
- Adoption
- Insufficient
- Hype gap+10
- Incentives35
- Confidence68
buildOne report1 publisher LiteLLM's MCP test endpoints let any valid proxy key run arbitrary commands on the gateway, rated CVSS 8.8. CISA added the flaw to its Known Exploited Vulnerabilities catalog on June 8, 2026, confirming exploitation in the wild.
Reality
- Evidence50
- Adoption
- Insufficient
- Hype gap+10
- Incentives
- Insufficient
- Confidence50
buildOne report1 publisher CISA's exploited-vulnerability catalog now holds entries for LiteLLM, Kestra and Starlette, according to a dev.to writeup, and the quickstart docs for those tools still keep provider API keys in the process environment an attacker reads first.
Reality
- Evidence28
- Adoption
- Insufficient
- Hype gap+42
- Incentives32
- Confidence34
buildOne report1 publisher A dev.to engineer ran three FastAPI apps against the same dist directory and found that a catch-all declared above /api/ping answers 200 with index.html, while the new frontend() helper answered correctly from the wrong position.
Reality
- Evidence74
- Adoption24
- Hype gap−8
- Incentives22
- Confidence67
buildOne report1 publisher CVE-2026-48710 is in CISA's Known Exploited Vulnerabilities catalog, scored 6.5 by Starlette's maintainers and 10.0 by Horizon3.ai once chained with a LiteLLM command injection. Version 1.0.1 is the fix.
Reality
- Evidence45
- Adoption55
- Hype gap+12
- Incentives65
- Confidence50
buildOne report1 publisher Starlette resolves the route after the middleware stack has already run, so a geolocation middleware fires on /health and /docs as well. A per-route dependency scopes the same lookup to the handlers that actually need it.
Reality
- Evidence58
- Adoption
- Insufficient
- Hype gap+18
- Incentives30
- Confidence58
buildOne report1 publisher The upgrade request is an HTTP GET that carries session cookies cross-origin with no preflight, so CORS never sees it, and the frameworks that could check the Origin header for you mostly hand that job to your route code.
Reality
- Evidence55
- Adoption
- Insufficient
- Hype gap+18
- Incentives30
- Confidence52
buildOne report1 publisher X41 D-Sec's proof of concept for CVE-2026-48710 is one unauthenticated GET whose Host header carries /public?bar=. Starlette sits underneath LiteLLM, vLLM and MCP servers, so the work starts with a dependency query.
Reality
- Evidence56
- Adoption
- Insufficient
- Hype gap+18
- Incentives55
- Confidence52
buildOne report1 publisher Seven entries went into CISA's known-exploited catalog on 2 September. The 5 September fix date covers four of the six products named, and the two AI-stack entries are the ones most teams cannot locate in a dependency graph.
Reality
- Evidence58
- Adoption34
- Hype gap+15
- Incentives30
- Confidence56
Ninety days of Wiz honeypot telemetry shows tooling written for LiteLLM's internals, including a config test endpoint that spawns whatever command it is handed and a miner whose output comes home inside the MCP protocol.
Reality
- Evidence62
- Adoption66
- Hype gap+12
- Incentives72
- Confidence55
Three Microsoft investigations into AI middleware ended in stolen keys, persistence and compute abuse. The remediation list is ordinary infrastructure hygiene, applied to plumbing nobody inventoried.
Reality
- Evidence66
- Adoption42
- Hype gap+12
- Incentives68
- Confidence52