--- reference_key: litellm-sqli title: "The Hacker News --- LiteLLM CVE-2026-42208 exploited within 36h" url: "https://thehackernews.com/2026/04/litellm-cve-2026-42208-sql-injection.html" availability: available capture_method: primary captured_at: 2026-06-23T03:31:12Z document_id: REF-litellm-sqli --- # The Hacker News --- LiteLLM CVE-2026-42208 exploited within 36h | Field | Value | |-------|-------| | **Reference key** | `litellm-sqli` | | **Availability** | AVAILABLE | | **Capture method** | `primary` | | **Source type** | remote_url | | **URL / path** | https://thehackernews.com/2026/04/litellm-cve-2026-42208-sql-injection.html | | **Captured (UTC)** | 2026-06-23T03:31:12Z | | **Content type** | text/html; charset=UTF-8 | | **HTTP status** | 200 | ## Boardroom Citation Context Sub-36h exploitation timeline; P7-10 SLA. ## Source Location https://thehackernews.com/2026/04/litellm-cve-2026-42208-sql-injection.html ## Captured Content ```text LiteLLM CVE-2026-42208 SQL Injection Exploited within 36 Hours of Disclosure --> #1 Trusted Cybersecurity News Platform Followed by 5.70+ million Get the Latest News Home Newsletter Webinars Home Threat Intelligence Vulnerabilities Cyber Attacks Webinars Expert Insights Awards Resources Webinars Awards Free eBooks About Site About THN Jobs Advertise with us Contact/Tip Us Reach out to get featured---contact us to send your exclusive story idea, research, hacks, or ask us a question or leave a comment/feedback! Follow Us On Social Media RSS Feeds Email Alerts LiteLLM CVE-2026-42208 SQL Injection Exploited within 36 Hours of Disclosure Ravie Lakshmanan Apr 29, 2026 Vulnerability / Cloud Security In yet another instance of threat actors quickly jumping on the exploitation bandwagon, a newly disclosed critical security flaw in BerriAI's LiteLLM Python package has come under active exploitation in the wild within 36 hours of the bug becoming public knowledge. The vulnerability, tracked as CVE-2026-42208 (CVSS score: 9.3), is an SQL injection that could be exploited to modify the underlying LiteLLM proxy database. "A database query used during proxy API key checks mixed the caller-supplied key value into the query text instead of passing it as a separate parameter," LiteLLM maintainers said in an alert last week. "An unauthenticated attacker could send a specially crafted Authorization header to any LLM API route (for example, POST /chat/completions) and reach this query through the proxy's error-handling path. An attacker could read data from the proxy's database and may be able to modify it, leading to unauthorized access to the proxy and the credentials it manages." The shortcoming affects the following versions - >=1.81.16 <1.83.7 While the vulnerability was addressed in version 1.83.7-stable released on April 19, 2026, the first exploitation attempt was recorded on April 26 at 16:17 UTC, roughly 26 hours and seven minutes after the GitHub advisory was indexed in the global GitHub Advisory Database. The SQL injection activity, per Sysdig, originated from the IP address 65.111.27[.]132. "Malicious activity fell into two phases driven by the same operator across two adjacent egress IPs, followed by a brief unauthenticated probe of the key-management endpoints," security researcher Michael Clark said . Specifically, the unknown threat actor is said to have targeted database tables like "litellm_credentials.credential_values" and "litellm_config" that hold information related to upstream large language model (LLM) provider keys and the proxy runtime environment. No probes were observed against tables like "litellm_users" or "litellm_team." This suggests that the attacker was not only aware of these tables, but also went after those that hold sensitive secrets. In the second phase of the attack, observed after 20 minutes, the threat actor used a different IP address ("65.111.25[.]67"), this time abusing the access to run a similar probe. LiteLLM is a popular, open-source AI Gateway software with over 45,000 stars and 7,600 forks on GitHub. Last month, the project was the target of a supply chain attack orchestrated by the TeamPCP hacking group to steal credentials and secrets from downstream users. "A single litellm_credentials row often holds an OpenAI organization key with five-figure monthly spend caps, an Anthropic console key with workspace admin rights, and an AWS Bedrock IAM credential," Sysdig said. "The blast radius of a successful database extraction is closer to a cloud-account compromise than a typical web-app SQL injection." Users are advised to patch their instances to the latest version. If this is not an immediate option, the maintainers recommend setting "disable_error_logs: true" under "general_settings" to remove the path through which untrusted input reaches the vulnerable query. "The LiteLLM vulnerability (GHSA-r75f-5x8p-qvmc) continues the modal pattern for AI-infrastructure advisories: critical, pre-auth, and in software with five-figure star counts that operators trust to centralize cloud-grade credentials," Sysdig added. "The 36-hour exploit window is consistent with the broader collapse documented by the Zero Day Clock, and the operator behavior we recorded (verbatim Prisma table names, three-table targeting, deliberate column-count enumeration) shows that exploitation no longer waits for a public PoC. The advisory and the open-source schema were ultimately enough." Update The U.S. Cybersecurity and Infrastructure Security Agency (CISA), on May 8, 2026, added CVE-2026-42208 to its Known Exploited Vulnerabilities ( KEV ) catalog, requiring Federal Civilian Executive Branch (FCEB) agencies to apply the patches by May 11, 2026. Found this article interesting? Follow us on Google News , Twitter and LinkedIn to read more exclusive content we post. SHARE Tweet Share Share Share Share on Facebook Share on Twitter Share on Linkedin Share on Reddit Share on Hacker News Share on Email Share on WhatsApp Share on Facebook Messenger Share on Telegram SHARE AI Infrastructure , Cloud security , cybersecurity , data breach , GitHub , Open Source , sql injection , supply chain attack , Vulnerability Top Stories This Week Chrome V8 Zero-Day CVE-2026-11645 Exploited in the Wild - Patch Now Researchers Build Self-Replicating AI Worm That Operates Entirely on Local, Open-Weight Models Microsoft Defender RoguePlanet Zero-Day Grants SYSTEM Access on Updated Windows Anthropic Releases Claude Fable 5, Its Most Powerful AI Yet, With Cyber Safeguards Microsoft Patches Record 206 Flaws, Including Three Zero-Days and Critical RCE Bugs Ivanti, Fortinet, and SAP Release Patches for Multiple Critical Vulnerabilities Cybersecurity Stars Awards 2026: Winners Announced Across 95 Categories ThreatsDay Bulletin: Worm Code Leaked, AI Agent Phished, Claude Code Patch + 28 New Stories New GreatXML Exploit Bypasses Windows BitLocker via Recovery Partition XML Files Agentjacking Attack Tricks AI Coding Agents Into Running Malicious Code China-Linked Hackers Backdoored Linux Login Software to Hide for Nearly a Decade Critical Splunk Enterprise Flaw Lets Attackers Run Code Without Authentication U.S. Orders Anthropic to Suspend Fable 5 and Mythos 5 Access for Foreign Nationals Over 400 Arch Linux AUR Packages Hijacked to Deploy Infostealer and eBPF Rootkit Palo Alto Warns of Active Exploitation of PAN-OS GlobalProtect VPN Flaw Weekly Recap: Chrome 0-Day, UniFi Exploits, macOS Stealers, VPN Flaw and More Featured Resources Get the 2026 Guide to Govern and Secure Enterprise AI Agents at Scale [Watch Demo] See Which Security Gaps Attackers Could Exploit First AI Cant Stop Every Attack. Learn How Zero Trust Can Block Whats Unknown Have You Outgrown Your MDR? 7 Warning Signs Every CISO Should Check Cybersecurity Webinars A Practical Security Guide How to Find and Govern Hidden AI Use Across Your Business Learn how to uncover hidden AI use, see what data it can access, map every AI action to a human owner, and apply practical governance without heavy infrastructure changes. Register Tired of False Positives? How to Stop AI-Powered Attacks Before They Move Across Your Network Learn how to contain Mythos-style AI attacks with practical Zero Trust controls that reduce exposure, stop lateral movement, and limit risk. Register Latest News Cybersecurity Resources 5 Steps to Secure Against Software Vulnerabilities Discovered by AI Models AI has emerged as a potent weapon in cybersecurity. Learn how to best safeguard your organization. The CISOs Guide: Transitioning from VPN to Comprehensive ZTNA Modernize secure access and eliminate lateral movement by connecting users directly to applications, not the network. Earn a Master's in Cybersecurity Risk Management Lead the future of cybersecurity risk management with an online Masters from Georgetown. Expert Insights Articles Videos Building a Security Strategy for AI-Powered Ransomware Attacks June 22, 2026 Read Identity Security in 2026: The Brutal Truth Enterprises Still Avoid June 22, 2026 Read Beyond Blocking: Disrupting the Social Engineering Attack Chain June 22, 2026 Read Why Runtime Scanning Is Too Late for Your CI/CD Supply Chain Security June 15, 2026 Read Get the Latest News in Your Inbox Get the latest news, expert insights, exclusive resources, and strategies from industry leaders, all for free. Email Connect with us! 1,500,000 Followers 713,100 Followers 25,500 Subscribers 165,000 Followers 1,990,000 Followers 55,500 Followers Company About THN Advertise with us Contact Pages Webinars Awards Privacy Policy RSS Feeds Contact Us 2026 The Hacker News. All Rights Reserved. ``` --- *Archived reference article for AICSR-STUDY-2026-001 footnote corpus.*