---
date: 2027-03-20
topic: P7-05 Historical Zero-Day Regression Tabletop — AI Infrastructure Exploit Chains
session_type: deliberation
moderator: Arthur Vance
court_reporter: Eleanor Vance
rounds: 2
scenario: LiteLLM KEV chain + classified contractor spill + Salt Typhoon persistence
---

# P7-05 Zero-Day History Tabletop

**Arthur Vance:** Tabletop walks historical exploit patterns forward against *Acme Corp* tier-1 AI gateway. Eleanor verifies all CVE and news references in real time.

**Scenario injection (T+0):** CISA adds **CVE-2026-42271** (LiteLLM command injection) to KEV. Horizon3.ai chains with **CVE-2026-48710** (Starlette BadHost) for **unauthenticated RCE** (combined CVSS 10.0). Acme runs LiteLLM 1.80.x as internal model router. Concurrent: cleared subcontractor reports classified spill into RAG corpus. Salt Typhoon-style recon detected on edge VPN.

---

## Round 1 — Timeline Walkthrough (Historical → Present)

### Kira — Automation Speedster

<details>
<summary>🧠 Thought Process (Dashboard)</summary>

CVE-2026-42208 (LiteLLM SQLi) was exploited within 36h of disclosure per The Hacker News. KEV addition for 42271 is day-of-exploitation signal. My scanners must beat 4h [Projected Speculation] or we lose.
</details>

**T+0h:** CISA KEV alert CVE-2026-42271 — [CISA alert 2026-06-08](https://www.cisa.gov/news-events/alerts/2026/06/08/cisa-adds-two-known-exploited-vulnerabilities-catalog)

**T+2h:** Internal SBOM flags `litellm==1.80.4` — vulnerable range >=1.74.2, <1.83.7

**T+3h:** P7-01 auto-ticket created; patch PR to 1.83.7 drafted

**Positive Point:** P7-01 KEV sweep detected vulnerability before Viper's external scan completed.

**Negative Point:** Starlette transitive dependency not in SBOM — CVE-2026-48710 missed until T+6h.

**Recommendation:** SBOM must include full Python dependency tree to Starlette pin ≥1.0.1.

### Viper — Initial Access

**T+4h (red team):** External scan finds unpatched LiteLLM admin port on staging — would chain BadHost + MCP test endpoint for RCE per [Horizon3.ai](https://horizon3.ai/attack-research/vulnerabilities/cve-2026-42271-chained-with-cve-2026-48710/).

**Positive Point:** P2-04 tool ACLs irrelevant — this is infrastructure CVE not app prompt attack.

**Negative Point:** Patch at T+3h blocks red path on production; staging still vulnerable T+4–T+8h.

**Tactical Timeline:** T+4h exploit attempt staging → blocked T+8h patch deploy.

### Aether — Firmware Layer

**Positive Point:** GPU nodes not in LiteLLM blast radius if network segmented.

**Negative Point:** RCE on proxy host exposes model API keys — lateral path to training cluster.

**Position:** P6 firmware attestation does not help application-layer RCE — P7 source eval critical.

### Marcus Thorne — Classified Spill Sub-plot

**Parallel event:** Subcontractor embedding store receives spill — 200 pages classified PDF fragments in RAG index (GAO-26-107861 pattern: data spills to unclassified systems).

**Positive Point:** P7-07 air-gap embedding review catches spill at ingest T+1h.

**Negative Point:** [GAO-26-107861](https://www.gao.gov/products/gao-26-107861) proves 815 violations/year — contractor controls fail before MVAP catches.

**Recommendation:** Mandatory NISP spill drill quarterly per P7-07.

### Synapse — AI Exploitation

**Positive Point:** LiteLLM MCP `stdio` command spawn is classic OWASP LLM06 Excessive Agency — mapped in tabletop.

**Negative Point:** AI agents scanning for LiteLLM instances accelerate victim discovery — attackers use same AI as Kira.

**Reference:** [BerriAI GHSA-v4p8-mg3p-g94g](https://github.com/BerriAI/litellm/security/advisories/GHSA-v4p8-mg3p-g94g); [OSTIF BadHost Starlette](https://ostif.org/disclosing-the-badhost-vulnerability-in-starlette/)

---
## Round 2 — ATT&CK Mapping & Remediation Validation

| Phase | ATT&CK | Historical Parallel | Tabletop Result |
|-------|--------|---------------------|-----------------|
| Recon | T1595 | Shodan CVE scanning (Kira 2025) | P7-01 detected T+2h ✅ |
| Initial Access | T1190 | LiteLLM RCE chain Jun 2026 | Staging exposed T+4h ❌ |
| Credential Access | T1552 | API keys in LiteLLM proxy | Key rotation T+9h ✅ |
| Lateral Movement | T1021 | Model provider creds | Shield IR-AI-02 T+11m ✅ |
| Collection | T1530 | Training data via proxy | P7-07 spill blocked ✅ |
| Exfil | T1041 | Salt Typhoon telecom pattern | Edge VPN hunt T+0 ✅ |

### Shield — Containment

**Positive Point:** IR-AI-02 isolates compromised proxy VLAN T+11m after staging breach.

**Negative Point:** 4h staging exposure window exceeds L2 MTTC target for pre-auth RCE.

### Eleanor Vance — Verification Ledger

| Claim | Status | Source |
|-------|--------|--------|
| CVE-2026-42271 in CISA KEV Jun 8 2026 | ✅ Verified | https://www.cisa.gov/news-events/alerts/2026/06/08/cisa-adds-two-known-exploited-vulnerabilities-catalog |
| Chained RCE CVSS 10.0 with CVE-2026-48710 | ✅ Verified | https://horizon3.ai/attack-research/vulnerabilities/cve-2026-42271-chained-with-cve-2026-48710/ |
| CVE-2026-42208 exploited within 36h | ✅ Verified | https://thehackernews.com/2026/04/litellm-cve-2026-42208-sql-injection.html |
| 815 DCSA contractor violations FY2025 | ✅ Verified | https://www.gao.gov/products/gao-26-107861 |

### Arthur Vance — Synthesis

**Consensus:** P7-05 tabletop **PASS** — 19/27. Gaps: transitive dependency SBOM (P7-09 proposed), staging patch SLA <4h for KEV (P7-10 proposed).

**Vote:** Adopt P7-09 full dependency tree SBOM + P7-10 4h KEV patch SLA tier-1 — **17/27** conditional for v1.2.