{"id":4099,"date":"2026-11-08T09:48:43","date_gmt":"2026-11-08T17:48:43","guid":{"rendered":"https:\/\/cyber.mag212.com\/llmjacking-litellm-cve-2026-40217-cloud-ai-bills\/"},"modified":"2026-11-08T09:48:43","modified_gmt":"2026-11-08T17:48:43","slug":"llmjacking-litellm-cve-2026-40217-cloud-ai-bills","status":"publish","type":"post","link":"https:\/\/cyber.mag212.com\/fr\/llmjacking-litellm-cve-2026-40217-cloud-ai-bills\/","title":{"rendered":"LLMjacking: Stolen Cloud AI Keys Run Up $1M Bills, LiteLLM Gateway Flaw Exploited"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Attackers who steal cloud credentials are now spending them on AI model calls rather than on cryptomining. Google Threat Intelligence Group (GTIG) and Mandiant say some victims of this &#8220;LLMjacking&#8221; were hit with more than $100,000 in fraudulent charges in a single day and up to $1 million in total. The same report says one intrusion used a LiteLLM gateway flaw, labelled CVE-2026-40217, to turn ordinary keys into full admin credentials. The public CVE record for that ID describes a different LiteLLM bug, so defenders should check both issues.<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table><tbody><tr><td><strong>What<\/strong><\/td><td>LLMjacking: stolen cloud and API credentials used to run, and resell, paid LLM inference at the victim&#8217;s expense<\/td><\/tr><tr><td><strong>Reported<\/strong><\/td><td>2 November 2026 (Google Cloud blog, GTIG\/Mandiant); covered by SecurityWeek and The Hacker News on 6 November<\/td><\/tr><tr><td><strong>Victims<\/strong><\/td><td>Finance, retail, technology and transport firms in the Americas and Asia Pacific<\/td><\/tr><tr><td><strong>Losses<\/strong><\/td><td>More than $100,000 in a single day; up to $1 million in total at some organisations<\/td><\/tr><tr><td><strong>Platforms in detection guidance<\/strong><\/td><td>AWS Bedrock, Azure OpenAI \/ Cognitive Services, Google Vertex AI, LiteLLM gateways, exposed Ollama servers<\/td><\/tr><tr><td><strong>LiteLLM CVE-2026-40217<\/strong><\/td><td>Google: <code>\/key\/regenerate<\/code> user-ID rebind to <code>PROXY_ADMIN<\/code>, exploited in one intrusion. Official GitHub advisory: custom-code guardrail sandbox escape, fixed in 1.83.10\/1.83.11<\/td><\/tr><tr><td><strong>Action<\/strong><\/td><td>Set spending caps and quotas, turn on model-invocation logging, alert on logging changes, rotate keys, upgrade LiteLLM to the latest release<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">What happened<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Mandiant investigated several LLMjacking incidents in 2026 across multiple providers. Unlike cryptojacking, charges can spike within hours; one tracked actor, UNC6993, ran up more than $100,000 on its own. GTIG expects attackers to favour LLMjacking over older forms of resource theft such as cryptomining, and to target exposed API tokens and model-routing middleware.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The stolen access is resold through what Google calls &#8220;LLM mixers&#8221;: illicit gateways that pool stolen keys and sell model access to subscribers. One reseller, Jet Night, made more than 500,000 LLM API calls in under eight hours, which left one victim with nearly $1 million in token costs. It advertises an &#8220;unlimited&#8221; plan for about $60 a month. GTIG notes that legitimate equivalents cost $100 to $250 a month, a sign the service runs on stolen keys.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1800\" height=\"1013\" src=\"https:\/\/cyber.mag212.com\/wp-content\/uploads\/2026\/11\/llmjacking-litellm-cve-2026-40217-cloud-ai-bills-diagram.jpg\" alt=\"LLMjacking attack chain from stolen credentials through key validation, model enablement, log evasion and LiteLLM escalation to LLM mixer resale, with matching detection events\" class=\"wp-image-4098\" srcset=\"https:\/\/cyber.mag212.com\/wp-content\/uploads\/2026\/11\/llmjacking-litellm-cve-2026-40217-cloud-ai-bills-diagram.jpg 1800w, https:\/\/cyber.mag212.com\/wp-content\/uploads\/2026\/11\/llmjacking-litellm-cve-2026-40217-cloud-ai-bills-diagram-300x169.jpg 300w, https:\/\/cyber.mag212.com\/wp-content\/uploads\/2026\/11\/llmjacking-litellm-cve-2026-40217-cloud-ai-bills-diagram-1024x576.jpg 1024w, https:\/\/cyber.mag212.com\/wp-content\/uploads\/2026\/11\/llmjacking-litellm-cve-2026-40217-cloud-ai-bills-diagram-768x432.jpg 768w, https:\/\/cyber.mag212.com\/wp-content\/uploads\/2026\/11\/llmjacking-litellm-cve-2026-40217-cloud-ai-bills-diagram-1536x864.jpg 1536w, https:\/\/cyber.mag212.com\/wp-content\/uploads\/2026\/11\/llmjacking-litellm-cve-2026-40217-cloud-ai-bills-diagram-18x10.jpg 18w\" sizes=\"auto, (max-width: 1800px) 100vw, 1800px\" \/><figcaption class=\"wp-element-caption\">Diagram: MAG212 CYBER<\/figcaption><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">How the attack works<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Initial access.<\/strong> The main way in is exposed or stolen cloud identity material: IAM credentials, service-account keys, GitHub personal access tokens and live session tokens. Google describes several variants:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>UNC6993<\/strong> got into a cloud instance through a misconfigured service-account key. It also ran a fake application portal where victims pasted a raw JSON payload containing an active access token. The backend replayed the token, which bypassed both password and MFA checks.<\/li>\n\n\n\n<li>Another actor used compromised corporate IAM credentials and <strong>cloud federation tokens<\/strong> to generate fresh access keys programmatically, which got around MFA.<\/li>\n\n\n\n<li>One actor harvested LLM API keys from public GitHub repositories and tested them with single-token requests (<code>max_tokens=1<\/code>). These stay under volume alerts.<\/li>\n\n\n\n<li>Actors also probed exposed <strong>Ollama<\/strong> endpoints with <code>\/api\/create<\/code> to register their own models on servers they did not own.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Enablement and persistence.<\/strong> In several cases the victim had never turned on the model service. Attackers enabled it, created extra API keys and signed victims up for pay-as-you-go premium models. One actor cycled short-lived service accounts to evade rate limits; others planted backdoor accounts and SSH keys.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Monetization.<\/strong> GTIG believes UNC6993 used the <code>new-api<\/code> hub to pool stolen keys and balance load. <code>gcli2api<\/code> turns CLI tools into standard model endpoints. A custom relay, ai-relay, on lookalike domains fed stolen access into the newapi[.]pro resale ecosystem.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">CVE-2026-40217: two different descriptions<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">According to Google, a follow-on cluster took Virtual Keys from the initial-access actor and attacked the victim&#8217;s LiteLLM gateway. It exploited a user-ID rebind flaw in the <code>\/key\/regenerate<\/code> endpoint to turn standard Virtual Keys into full <code>PROXY_ADMIN<\/code> master credentials. Google calls this CVE-2026-40217. Its post gives no CVSS score and no affected or fixed versions, and neither does SecurityWeek.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The public records for CVE-2026-40217 describe something else. LiteLLM&#8217;s GitHub advisory GHSA-wxxx-gvqv-xp7p (7 May 2026) and Red Hat&#8217;s CVE page describe a sandbox escape in the custom-code guardrail (<code>POST \/guardrails\/test_custom_code<\/code>). The advisory lists the affected range as <code>litellm<\/code> versions 1.81.8 up to but not including 1.83.10. Its patched-version field says 1.83.10; its text says 1.83.11. That bug needs a proxy-admin credential by default, which is exactly what Google says the rebind provides. We found no LiteLLM advisory or release note that mentions <code>\/key\/regenerate<\/code> or a user-ID rebind. We cannot confirm the affected or fixed versions for the bug Google describes, or whether Google&#8217;s CVE label is a mistake. Treat the version guidance below as covering the documented sandbox escape only.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Indicators and detection<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Google&#8217;s main rule: treat any unauthorised enablement of an LLM service as a critical event. Its log events:<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table><thead><tr><th>Platform \/ log<\/th><th>Abuse (invocation)<\/th><th>Recon and enablement<\/th><th>Evasion and anomalies<\/th><\/tr><\/thead><tbody><tr><td>AWS CloudTrail (<code>bedrock.amazonaws.com<\/code>)<\/td><td><code>Converse<\/code>, <code>InvokeModel<\/code>, <code>InvokeModelWithResponseStream<\/code><\/td><td><code>ListFoundationModels<\/code>, <code>ListInferenceProfiles<\/code>, <code>GetFoundationModelAvailability<\/code>; unlocks via <code>PutUseCaseForModelAccess<\/code>, <code>CreateFoundationModelAgreement<\/code><\/td><td><code>Get\/Put\/DeleteModelInvocationLoggingConfiguration<\/code> (disabling by a non-IaC principal is high severity); spikes in <code>ThrottlingException<\/code>, <code>ValidationException<\/code>, <code>ResourceNotFoundException<\/code>; SDK user agents such as <code>claude-cli<\/code>, <code>aws-sdk-rust<\/code>, <code>aws-sdk-go-v2<\/code> (examples to review, not malicious IOCs)<\/td><\/tr><tr><td>Azure Activity and Diagnostic logs (<code>Microsoft.CognitiveServices<\/code>)<\/td><td>High-volume Completions \/ Chat Completions POSTs (diagnostic logs); <code>accounts\/deployments\/write<\/code><\/td><td><code>accounts\/read<\/code>, <code>accounts\/deployments\/read<\/code><\/td><td><code>Microsoft.Insights\/diagnosticSettings\/read<\/code>, <code>\/write<\/code>, <code>\/delete<\/code><\/td><\/tr><tr><td>GCP Cloud Audit Logs (<code>aiplatform.googleapis.com<\/code>)<\/td><td><code>PredictionService.Predict<\/code>, <code>GenerateContent<\/code>, <code>StreamGenerateContent<\/code> (Data Access logs, off by default)<\/td><td><code>ServiceUsage.EnableService<\/code>; <code>ListModels<\/code>, <code>ListEndpoints<\/code>, <code>ListPublisherModels<\/code><\/td><td><code>GetIamPolicy<\/code>, <code>ConfigServiceV2.ListSinks<\/code>, <code>GetSink<\/code><\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Network IOCs.<\/strong> Google&#8217;s IOC table lists two LLM mixer domains: <code>jet-night[.]com<\/code> and <code>newapi[.]pro<\/code>. More are in a VirusTotal GTI collection. The Hacker News separately reported Bedrock-key resale sites <code>llm-routing[.]com<\/code> and <code>xingjiabiapi[.]org<\/code> (apparently from Wiz research) and four key-testing IPs: <code>23.106.46[.]239<\/code>, <code>38.246.114[.]118<\/code>, <code>104.243.32[.]50<\/code> and <code>31.57.201[.]201<\/code>. These are not in Google&#8217;s table and THN names no source for the IPs; treat them as single-sourced.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>MAG212 starting points, not vendor-supplied.<\/strong> These queries are our own. Test and adapt field names, log groups and time windows first.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">AWS CLI: list recent changes to Bedrock logging and model access (run in each region you use).<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code># MAG212 starting point\nfor ev in DeleteModelInvocationLoggingConfiguration PutModelInvocationLoggingConfiguration \\\n          PutUseCaseForModelAccess CreateFoundationModelAgreement; do\n  aws cloudtrail lookup-events --region us-east-1 \\\n    --lookup-attributes AttributeKey=EventName,AttributeValue=$ev \\\n    --start-time \"$(date -u -d '-14 days' +%FT%TZ)\" \\\n    --query 'Events[].[EventTime,EventName,Username]' --output table\ndone<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">CloudWatch Logs Insights, run on a CloudTrail log group: find Bedrock error spikes and the principals and user agents behind them.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code># MAG212 starting point\nfields @timestamp, eventName, userIdentity.arn, sourceIPAddress, userAgent, errorCode\n| filter eventSource = \"bedrock.amazonaws.com\" and ispresent(errorCode)\n| stats count(*) as errors by userIdentity.arn, sourceIPAddress, userAgent, errorCode, bin(1h)\n| sort errors desc\n| limit 50<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">CloudTrail does not record request bodies, so <code>max_tokens=1<\/code> sweeps are easier to spot in Bedrock model-invocation logs. Run this on the invocation log group if logging is enabled.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code># MAG212 starting point - Bedrock invocation log group\nfields @timestamp, identity.arn, modelId, output.outputTokenCount\n| filter output.outputTokenCount &lt;= 1\n| stats count(*) as tinyCalls by identity.arn, modelId, bin(10m)\n| sort tinyCalls desc<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">KQL for Microsoft Sentinel \/ Log Analytics: new model deployments and diagnostic-setting changes. The Activity Log generally records writes and deletes but not reads.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\/\/ MAG212 starting point\nAzureActivity\n| where TimeGenerated &gt; ago(14d)\n| where OperationNameValue in~ (\n    \"MICROSOFT.COGNITIVESERVICES\/ACCOUNTS\/DEPLOYMENTS\/WRITE\",\n    \"MICROSOFT.INSIGHTS\/DIAGNOSTICSETTINGS\/WRITE\",\n    \"MICROSOFT.INSIGHTS\/DIAGNOSTICSETTINGS\/DELETE\")\n| project TimeGenerated, Caller, CallerIpAddress, OperationNameValue, ActivityStatusValue, _ResourceId\n| order by TimeGenerated desc<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">GCP Logging filter: Vertex AI enablement and inference calls. Inference calls appear only if Data Access logs are on.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code># MAG212 starting point\ngcloud logging read '\n  (protoPayload.methodName=\"google.api.serviceusage.v1.ServiceUsage.EnableService\"\n   AND protoPayload.resourceName:\"aiplatform.googleapis.com\")\n  OR (protoPayload.serviceName=\"aiplatform.googleapis.com\"\n   AND protoPayload.methodName=~\"PredictionService\\.(Predict|GenerateContent|StreamGenerateContent)\")\n' --freshness=7d --format='table(timestamp,protoPayload.methodName,protoPayload.authenticationInfo.principalEmail)'<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">What to do now<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Items 1 to 6 summarise Google&#8217;s recommendations. Items marked as MAG212 recommendations are our own.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>1. Cap spending.<\/strong> Set per-model API quotas and spending caps, and scope API keys by model, environment and usage so that a basic key cannot call expensive frontier models.<\/li>\n\n\n\n<li><strong>2. Clean up keys.<\/strong> Use centralised secrets management with automatic rotation, run secret scanning on GitHub and GitLab, and deny LLM-service permissions to identities that do not need them.<\/li>\n\n\n\n<li><strong>3. Use phishing-resistant MFA<\/strong> across identity providers, cloud consoles and developer platforms. MAG212 note: the token-paste portal also shows that MFA does not protect a token once it is issued, so keep token lifetimes short.<\/li>\n\n\n\n<li><strong>4. Log and alert.<\/strong> Treat any change to model-invocation logging or diagnostic settings as high severity, enable GCP Data Access logs for Vertex AI, and alert on <code>max_tokens=1<\/code> or zero-temperature validation pings.<\/li>\n\n\n\n<li><strong>5. Patch gateways.<\/strong> Include LiteLLM and other model proxies in patch management. MAG212 recommendation: run at least 1.83.11 for the documented guardrail sandbox escape, preferably the current release, and block <code>\/guardrails\/test_custom_code<\/code> at the reverse proxy if you do not use it.<\/li>\n\n\n\n<li><strong>6. Restrict access.<\/strong> Rate-limit per client with a WAF, allow-list egress where you can, and find shadow LLM deployments, including Ollama servers reachable from the internet.<\/li>\n\n\n\n<li><strong>MAG212 recommendation: assume LiteLLM keys are exposed.<\/strong> If a LiteLLM gateway faces untrusted users, rotate the master key and all Virtual Keys. Review key-regeneration activity and unexpected owner or role changes.<\/li>\n\n\n\n<li><strong>MAG212 recommendation: set billing alarms.<\/strong> Set cloud budget alerts well below a normal day&#8217;s model spend; losses reached six figures within hours.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">What we still don&#8217;t know<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Which LiteLLM versions contain the <code>\/key\/regenerate<\/code> rebind flaw, which version fixes it, and whether CVE-2026-40217 is the right identifier for it.<\/li>\n\n\n\n<li>Victim count and total losses; Google gives per-incident figures only.<\/li>\n\n\n\n<li>The original source of the four key-testing IPs reported by The Hacker News.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Related on MAG212 CYBER<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/cyber.mag212.com\/the-trusted-path-mag212-cyber-daily-november-8-2026\/\">The Trusted Path: MAG212 CYBER Daily, November 8, 2026<\/a><\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Sources<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/cloud.google.com\/blog\/topics\/threat-intelligence\/llmjacking-monetizing-compromised-cloud-models\" target=\"_blank\" rel=\"noopener\">Google Cloud (GTIG \/ Mandiant): The Rise of LLMJacking: How Threat Actors Monetize Compromised Cloud and Model Resources<\/a> (2 November 2026)<\/li>\n\n\n\n<li><a href=\"https:\/\/www.securityweek.com\/in-other-news-trezor-implant-llmjacking-bills-hit-1m-sap-flaws-weaponized-within-days\/\" target=\"_blank\" rel=\"noopener\">SecurityWeek: In Other News: Trezor Implant, LLMJacking Bills Hit $1M, SAP Flaws Weaponized Within Days<\/a> (6 November 2026)<\/li>\n\n\n\n<li><a href=\"https:\/\/thehackernews.com\/2026\/11\/chainalysis-breach-exposes-all-users.html\" target=\"_blank\" rel=\"noopener\">The Hacker News: Chainalysis Breach Exposes All Users&#8217; Credentials, Forces Shutdown of Key Services<\/a> (6 November 2026; section &#8220;Rise in AI-Linked Attacks&#8221;)<\/li>\n\n\n\n<li><a href=\"https:\/\/github.com\/BerriAI\/litellm\/security\/advisories\/GHSA-wxxx-gvqv-xp7p\" target=\"_blank\" rel=\"noopener\">LiteLLM (GitHub): Sandbox escape in custom-code guardrail, GHSA-wxxx-gvqv-xp7p \/ CVE-2026-40217<\/a> (7 May 2026)<\/li>\n\n\n\n<li><a href=\"https:\/\/access.redhat.com\/security\/cve\/CVE-2026-40217\" target=\"_blank\" rel=\"noopener\">Red Hat: CVE-2026-40217<\/a> (accessed 8 November 2026)<\/li>\n\n\n\n<li><a href=\"https:\/\/www.x41-dsec.de\/lab\/advisories\/x41-2026-001-litellm\/\" target=\"_blank\" rel=\"noopener\">X41 D-Sec: X41-2026-001, Guardrail Sandbox Escape in LiteLLM<\/a> (8 April 2026)<\/li>\n\n\n\n<li><a href=\"https:\/\/github.com\/BerriAI\/litellm\/releases\" target=\"_blank\" rel=\"noopener\">LiteLLM (GitHub): Releases<\/a> (accessed 8 November 2026)<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><em>Written and edited by El Mostafa Ouchen for MAG212 CYBER. Facts verified against the sources above as of 8 November 2026.<\/em><\/p>\n\n","protected":false},"excerpt":{"rendered":"<p>GTIG and Mandiant say stolen cloud AI keys are resold through LLM mixers, costing victims up to $1M. Detection events for Bedrock, Azure and Vertex AI, IOCs, and the LiteLLM CVE-2026-40217 discrepancy.<\/p>","protected":false},"author":1,"featured_media":4097,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[38,15,14],"tags":[278,279,281,275,282,277,55,239,276,280],"class_list":["post-4099","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-artificial-intelligence","category-threat-intelligence","category-vulnerabilities","tag-aws-bedrock","tag-azure-openai","tag-cloud-security","tag-cve-2026-40217","tag-detection-engineering","tag-google-threat-intelligence","tag-litellm","tag-llmjacking","tag-mandiant","tag-vertex-ai"],"_links":{"self":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/posts\/4099","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/comments?post=4099"}],"version-history":[{"count":0,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/posts\/4099\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/media\/4097"}],"wp:attachment":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/media?parent=4099"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/categories?post=4099"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/tags?post=4099"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}