Critical LiteLLM SQL Injection Vulnerability Exploited in the Wild

Cybersecuritynews •Abinaya • April 28, 2026

A critical pre-authentication SQL injection vulnerability in LiteLLM, a widely used open-source AI gateway with over 22,000 GitHub stars, is actively being exploited in the wild. Tracked as CVE-2026-42208, this severe flaw allows unauthorized attackers to extract highly sensitive cloud and AI provider credentials directly from the platform’s PostgreSQL database. LiteLLM acts as a central […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical SQL Injection Vulnerability in LiteLLM Actively Exploited Hackers are exploiting a critical SQL injection vulnerability in the LiteLLM open-source large-language model gateway, tracked as CVE-2026-42208. This pre-authentication flaw allows attackers to access sensitive information, including API keys and provider credentials, without authentication by sending a crafted Authorization header to any LLM API route. Exploitation began approximately 36 hours after the vulnerability was disclosed on April 24, 2026. The attackers have been observed executing targeted SQL injection attempts against specific database tables, indicating a high level of knowledge about the system's structure. LiteLLM, which has over 45,000 stars on GitHub, is widely used for managing AI models and has previously been targeted in a supply-chain attack. A patch was released in version 1.83.7 to mitigate this vulnerability, but instances running older versions are at risk. Security experts recommend rotating all credentials stored in exposed LiteLLM instances. For those unable to upgrade, a temporary workaround is available. 8 sources 73

Extracted Entities

Critical LiteLLM SQL Injection Vulnerability Exploited in the Wild

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)

MITRE ATT&CK (1)

Platforms (1)