← Back to feed
2026-09-07 Mcp SecurityPrompt Injection TLP:CLEAR

Wiz Threat Research: MCP Server RCE Exploitation Chain via CVE-2026-59822 & CVE-2026-42271

Date: 2026-09-07
Tags: mcp-security, prompt-injection

Executive Summary

Wiz Threat Research ran honeypots mimicking LiteLLM, Flowise, LangChain, Langflow, ChromaDB, and Ollama for 90 days and found three distinct attack patterns: MCP server RCE chaining CVE-2026-59822 (an auth-bypass flaw) with CVE-2026-42271 (a command-injection bug), blind prompt injection against agent frameworks confirmed via DNS callbacks, and post-exploitation tooling built specifically to read LiteLLM's in-memory API keys. This represents active exploitation of AI gateway and agentic AI infrastructure vulnerabilities in the wild.

Campaign Summary

FieldDetail
Campaign / MalwareMCP Server RCE Exploitation via CVE Chaining
AttributionUnknown - Active Exploitation (confidence: medium)
TargetAI gateway deployments and agent frameworks: LiteLLM, Flowise, LangChain, Langflow, ChromaDB, Ollama
VectorAuthentication bypass + command injection vulnerability chaining in MCP server implementations
Statusactive
First Observed2026-09-01

Detailed Findings

Wiz identified three exploitation patterns in their honeypot telemetry: (1) MCP server remote code execution through auth-bypass (CVE-2026-59822) chained with command injection (CVE-2026-42271), (2) blind prompt injection attacks against agent frameworks confirmed through DNS callback exfiltration, and (3) post-exploitation tools purpose-built to extract API keys stored in LiteLLM memory. The existence of purpose-built post-exploitation tooling targeting LiteLLM API key extraction indicates a mature threat ecosystem specifically targeting AI infrastructure. This chain represents a complete compromise path from initial access through credential theft.

MITRE ATT&CK Mapping

TechniqueIDContext
Exploit Public-Facing ApplicationT1190Exploitation of authentication bypass and command injection vulnerabilities in publicly-accessible MCP servers and AI gateways
Credential AccessT1555In-memory extraction of LiteLLM API keys and cloud credentials from compromised AI gateway processes

IOCs

Domains

_CVE-2026-59822 and CVE-2026-42271 used in chained exploitation; post-exploitation tooling purpose-built for LiteLLM API key extraction_

Full URL Paths

_CVE-2026-59822 and CVE-2026-42271 used in chained exploitation; post-exploitation tooling purpose-built for LiteLLM API key extraction_

Splunk Format

_No IOCs available for Splunk query_

Package Indicators

npm:Flowise@unspecified

Affected Platforms

LiteLLM
Flowise
LangChain
Langflow
ChromaDB
Ollama

Detection Recommendations

  1. Immediately patch LiteLLM to version >1.83.6 (CVSS 8.7 for CVE-2026-42271). 2. Patch Flowise to latest version addressing CVE-2026-59822 authentication bypass. 3. Implement network segmentation to restrict MCP server access to trusted agents only. 4. Monitor for CreateAgreementRequest/AcceptAgreementRequest API calls and unusual DNS queries from MCP servers. 5. Implement API key rotation policies for LiteLLM and all integrated LLM provider credentials. 6. Enable audit logging on all MCP tool invocations with full input/output capture. 7. Scan for post-exploitation indicators: unexpected process creation, in-memory credential access, or DNS exfiltration from LiteLLM/Flowise processes. 8. Use runtime monitoring to detect blind prompt injection attempts (embedded instructions in retrieved documents). 9. Implement least-privilege access controls for MCP tool execution. 10. Monitor LiteLLM logs for authentication failures or privilege escalation attempts.

References