ReadingResearchRadarInvestment framework
Sign in / Sign up
← Back to reading
NewsMaterial3 min readDisconfirmAI Editorial

Higress Team: After Two Supply-Chain Poisonings of LiteLLM, the Blast Radius Depends on Default Permissions in Extension Code

Following the second supply-chain poisoning incident involving LiteLLM, the Higress team posits that while attacks cannot be entirely eradicated, the scope of damage is determined by the default permissions granted to extension code. Python-based proxies possess full process privileges through their dependencies and callbacks, whereas Wasm sandboxes restrict malicious code to request processing limits by revoking file system access, arbitrary network connectivity, and process spawning capabilities.

Verified 2026-11-11 18:00 GMT+8

On October 21, 2026, LiteLLM version 1.107.0 was isolated just 1.7 hours after its release on PyPI; however, attackers had already used stolen AWS credentials to invoke bedrock:ListFoundationModels within less than five hours. This marked the second supply-chain poisoning of LiteLLM within six months, with attackers targeting nearly identical assets: cloud credentials, SSH private keys, Kubernetes (K8s) tokens, and all upstream model API keys centrally stored in the proxy database.

In its incident analysis, the Higress team raised a more fundamental question than 'how to prevent poisoning': since poisoning will inevitably occur, how can we ensure that malicious code gains nothing even if it infiltrates the system? Their answer is that the true determinant of the blast radius is the amount of default privilege held by extension code.

This assessment stems from a comparison of two proxy architectures. LiteLLM operates as a Python process where third-party dependencies and custom callbacks are essentially in-process Python code, possessing the exact same privileges as the proxy process itself—meaning files readable, environment variables visible, networks connectable, and subprocesses launchable by the proxy are equally accessible to malicious code. The infostealer in version 1.107.0 exploited this precisely: utilizing .pth startup hooks to execute automatically upon interpreter launch, it read ~/.aws/credentials, ~/.ssh/id_rsa, K8s ServiceAccount Tokens, and even connected directly to the proxy database to query the LiteLLM_CredentialsTable.

Sign in / Sign up
ReadingResearchRadarInvestment framework

Higress's solution involves constraining extension code within a Wasm sandbox. Its data plane is based on Envoy (C++), with core gateway capabilities implemented natively by Envoy; AI proxying, authentication, rate limiting, content security, and other extension capabilities run as Wasm plugins within Envoy's embedded Wasm virtual machine. The fundamental difference between Wasm plugins and Python dependencies lies in privilege: Python dependencies default to full process privileges, whereas Wasm plugins possess only the limited capabilities explicitly exposed by the host.

Specifically, according to the proxy-wasm-cpp-host source code, the Wasm sandbox revokes the following capabilities: No file system access (path_open always returns NOENT, preventing plugins from reading any files); Environment variables are invisible by default (environ_get returns only variables explicitly declared in the WasmPlugin vmConfig.env); No arbitrary network access (sock_send and sock_recv return ENOTSUP, requiring plugins to request Envoy to send requests on their behalf, which checks for the existence of target clusters); No process spawning (no fork/exec, preventing daemon generation or Pod deployment); Memory isolation (each plugin accesses only its own linear memory, unable to read TLS private keys from the Envoy process or data from other plugins).

The Higress team simultaneously acknowledges that sandboxes are not silver bullets: plugins can still read and write the requests and responses they handle, creating opportunities to exfiltrate data via responses; ai-proxy must hold upstream API Keys to forward requests. Therefore, they recommend combining this approach with least privilege (splitting capabilities across different plugins so authentication plugins only hold consumer credentials and model proxies only hold model keys), version pinning (referencing plugins by version number plus sha256 rather than latest), and managed credentials (using KMS encryption for key management in the Enterprise Edition).

Regarding the release process, starting from v2.2.4, Higress adopts immutable releases: build once, review snapshots, and promote by digest. Official version tags are immutable—if a tag with the same name already exists but has a different digest, the release fails immediately. This contrasts with the LiteLLM incident where latest and main-stable tags were repointed to malicious images.

It should be noted that this argument originates from Higress itself; its performance comparison data (such as a 68.8%–97.1% reduction in latency for 1 MB requests) represents vendor self-testing without independent reproduction. While sandbox attributes at the architecture level can be verified via open-source code, the overall security effectiveness of the solution ultimately depends on actual operational discipline and the integrity of the plugin ecosystem.

Sources

  • alibabacloud.comAlibaba Cloud Community↗
Continue researching →