Critical LiteLLM Flaw Enables Database Attacks Through SQL Injection

Gbhackers •Divya • April 28, 2026

A critical pre-authentication SQL injection vulnerability, identified as CVE-2026-42208, has been discovered in the popular LiteLLM gateway, allowing attackers to access databases without credentials. Cybercriminals have already been observed exploiting this flaw to target high-value secrets such as API keys and provider credentials. Overview of the Vulnerability CVE-2026-42208 is a critical flaw in LiteLLM, an […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical SQL Injection Vulnerability in LiteLLM Actively Exploited Hackers are exploiting a critical SQL injection vulnerability in the LiteLLM open-source large-language model gateway, tracked as CVE-2026-42208. This pre-authentication flaw allows attackers to access sensitive information, including API keys and provider credentials, without authentication by sending a crafted Authorization header to any LLM API route. Exploitation began approximately 36 hours after the vulnerability was disclosed on April 24, 2026. The attackers have been observed executing targeted SQL injection attempts against specific database tables, indicating a high level of knowledge about the system's structure. LiteLLM, which has over 45,000 stars on GitHub, is widely used for managing AI models and has previously been targeted in a supply-chain attack. A patch was released in version 1.83.7 to mitigate this vulnerability, but instances running older versions are at risk. Security experts recommend rotating all credentials stored in exposed LiteLLM instances. For those unable to upgrade, a temporary workaround is available. 8 sources 73

Extracted Entities

Critical LiteLLM Flaw Enables Database Attacks Through SQL Injection

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)

Tools (1)