The config test endpoint exists for a reasonable purpose. An operator wants to validate an MCP server before saving it, so LiteLLM spawns the configured command, and in CVE-2026-42271 that command field reaches subprocess execution with no validation [4]. The submitted configuration did two jobs at once: a Python payload that downloaded and ran a cryptominer, then a valid MCP handshake so the connection test came back clean [5].
The cleanup mechanism is worth laying out in full. The gmon process launches detached through `start_new_session=True`, and the staging directory is removed with `rmtree` while the running process keeps the binary's inode open, leaving a miner in memory and almost nothing on disk to inspect [10]. Command output is returned over MCP itself, embedded in the description field of a fake tool in the `tools/list` response [11]. Whoever built this implemented enough of the protocol to keep the console green and to carry shell output home on the same channel.
Preconditions decide how much of this matters. LiteLLM's MCP Gateway returns an empty `UserAPIKeyAuth()` object when OAuth2 token validation fails, and an object with no restrictions grants full MCP access, which is why the honeypots logged one-character bearer tokens against model enumeration [3]. Chained with the Starlette host header validation bypass CVE-2026-48710, the command injection becomes fully unauthenticated remote code execution [6]. CVE-2026-42271 was added to CISA's KEV catalogue in June 2026 [12]. Keep the sourcing separate: Wiz observed the exploitation in its own sensors [1], while the link to the Qilin ransomware group comes from external researchers [7].
Scale comes from Wiz's own census. It reports 90% of cloud environments running self-hosted AI software, 81% running managed AI services, and 63% self-hosting models [2]. Subtract the model hosts from the software hosts and 27 points of environments run self-hosted AI software without running a model of their own [1]. That gap includes proxies, along with frameworks and vector stores, each holding someone else's API keys and routing outward. One LiteLLM instance can carry keys for OpenAI, Anthropic, Azure and Gemini, run under a cloud IAM role, and reach internal services through MCP tool servers, so the blast radius of a single RCE is everything downstream [8].
Wiz organises the 90 days into three patterns, and only the MCP one is walked through in mechanism [13]. Blind prompt injection against agent frameworks and credential theft from agent memory are reported as observed, on the reasoning that agents accept external input and act on it [14]. Read the MCP chain as reproducible and the other two as telemetry until the detail lands. The generic version of the bug is the one to price: any tool that validates an MCP configuration by spawning the configured command fails the same way once that path is reachable [9].
