CVE-2026-42208 - Vulnerability Analysis
CriticalCVSS: 9.8Last Updated: May 8, 2026
LiteLLM - SQL Injection
Overview
LiteLLM 1.81.16 to < 1.83.7 contains a SQL injection caused by improper handling of caller-supplied key in database query during proxy API key checks, letting unauthenticated attackers read and modify database data, exploit requires crafted Authorization header.
Severity & Score
Impact
Unauthenticated attackers can read and modify proxy database, leading to unauthorized access and credential compromise.
Mitigation
Upgrade to version 1.83.7 or later.
References
- https://webflow.sysdig.com/blog/cve-2026-42208-targeted-sql-injection-against-litellms-authentication-path-discovered-36-hours-following-vulnerability-disclosure
- https://github.com/BerriAI/litellm/releases/tag/v1.83.7-stable
- https://github.com/BerriAI/litellm/security/advisories/GHSA-r75f-5x8p-qvmc
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-42208
Social Media Activity(7 posts)
LiteLLM-Sicherheitslücke CVE-2026-42208: SQL-Injection binnen 36 Stunden nach Veröffentlichung aktiv ausgenutzt https://www.all-about-security.de/litellm-sicherheitsluecke-cve-2026-42208-sql-injection-binnen-36-stunden-nach-veroeffentlichung-aktiv-ausgenutzt/ #llm #cve #cybersecurity
View original post
This is the issue with AI in criminal hands. Speed to market. https://thehackernews.com/2026/04/litellm-cve-2026-42208-sql-injection.html?m=1
View original post
LiteLLM-Sicherheitslücke CVE-2026-42208: SQL-Injection binnen 36 Stunden nach Veröffentlichung aktiv ausgenutzt https://www.all-about-security.de/litellm-sicherheitsluecke-cve-2026-42208-sql-injection-binnen-36-stunden-nach-veroeffentlichung-aktiv-ausgenutzt/ #llm #cve #cybersecurity
View original post
This is the issue with AI in criminal hands. Speed to market. https://thehackernews.com/2026/04/litellm-cve-2026-42208-sql-injection.html?m=1
View original post
Critical SQL Injection Vulnerability in LiteLLM AI Gateway Exploited in the Wild LiteLLM patched a critical pre-authentication SQL injection vulnerability (CVE-2026-42208) that allows attackers to steal cloud provider credentials and master API keys. The flaw was exploited in the wild within 36 hours of disclosure, targeting sensitive database tables used for AI gateway management. **If you run LiteLLM, update to version 1.83.7 immediately to patch CVE-2026-42208, and isolate the proxy from the internet so it's only reachable from trusted networks. Assume any internet-exposed instance has been compromised - rotate all virtual API keys and provider credentials (OpenAI, Anthropic, AWS Bedrock) right away.** #cybersecurity #infosec #attack #activeexploit https://beyondmachines.net/event_details/critical-sql-injection-vulnerability-in-litellm-ai-gateway-exploited-in-the-wild-i-p-i-0-n/gD2P6Ple2L
View original post
LiteLLM Proxy Gateway Under Active SQLi Exploitation Threat actors are exploiting CVE-2026-42208, a critical pre-authentication SQL injection flaw in LiteLLM, a widely-used open-source gateway for ... https://news-pravda.com/world/2026/04/29/2271838.html | https://awakari.com/sub-details.html?id=LLMs | https://awakari.com/pub-msg.html?id=DiyKS7nqDGghpL2qKv1z2lyYJBw&interestId=LLMs
View original post
CVE-2026-42208: Targeted SQL injection against LiteLLM's authentication path discovered 36 hours following vulnerability disclosure | Sysdig https://www.sysdig.com/blog/cve-2026-42208-targeted-sql-injection-against-litellms-authentication-path-discovered-36-hours-following-vulnerability-disclosure Read on HackerWorkspace: https://hackerworkspace.com/article/cve-2026-42208-targeted-sql-injection-against-litellm-s-authentication-path-discovered-36-hours-following-vulnerability-disclosure-sysdig #authentication #aisecurity #vulnerability
View original postGitHub Repositories(1 repo)
Related Resources
Details
- CVE ID
- CVE-2026-42208
- Severity
- Critical
- CVSS Score
- 9.8
- Type
- sql_injection
- Status
- confirmed
- EPSS
- 0.0%
- Social Posts
- 7
CWE
- CWE-89
CVSS Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H