A critical SQL injection in BerriAI’s LiteLLM Python package was exploited in the wild within 36 hours of public disclosure, according to a technical analysis. The issue, tracked as CVE-2026-42208, carries a CVSS score of 9.3 and affects versions 1.81.16 through 1.83.6.
KEY FACTS
- Bug type SQL injection in proxy API key checks
- Impact Attackers could read and possibly modify LiteLLM proxy database data
- Timeline First exploitation attempt was recorded on April 26 at 16:17 UTC
- Targeting Activity focused on tables holding provider keys and runtime configuration
- Fix Version 1.83.7-stable was released on April 19
The vulnerability came from a query used during proxy API key checks that mixed caller-supplied input into the SQL text instead of sending it as a separate parameter. An unauthenticated attacker could trigger the flaw by sending a crafted Authorization header to an LLM API route and reaching the vulnerable query through error handling.
The report says the first exploitation attempt came roughly 26 hours after the GitHub advisory was indexed in the global advisory database. The activity originated from 65.111.27.132, then moved about 20 minutes later to 65.111.25.67. The same operator targeted database tables including litellm_credentials.credential_values and litellm_config, while no probes were observed against litellm_users or litellm_team.
LiteLLM is an open-source AI gateway with more than 45,000 stars on GitHub. The project was also the target of a supply chain attack last month, adding to concerns around software that centralizes access to cloud and model credentials.
Users are advised to upgrade to the latest release. If immediate patching is not possible, maintainers recommend setting disable_error_logs to true under general_settings to block the path that lets untrusted input reach the vulnerable query.
WHY IT MATTERS
The disclosure shows how quickly attackers can act after a flaw becomes public, especially in software that stores sensitive provider keys and cloud credentials. For operators, the risk is not limited to a web application database, but can extend to broader account access if the proxy is compromised.