LiteLLM SQL injection exploited 36 hours after disclosure

#HEADER title=LiteLLM SQL injection exploited 36 hours after disclosure keywords=litellm,sql injection,cve-2026-42208,ai security,supply chain,sysdig #ENDHEADER

Someone started exploiting CVE-2026-42208 in LiteLLM roughly 36 hours after the advisory went public. No PoC needed. The GitHub advisory and the open-source schema were enough.

The vulnerability is a pre-auth SQL injection in LiteLLM’s proxy API key verification. An attacker sends a crafted Authorization header to any LLM API route, hits the error-handling path, and gets arbitrary SQL execution against the proxy database. CVSS 9.3. No login required.

Sysdig caught the whole thing. The first exploitation attempt came from IP 65.111.27[.]132 on April 26 at 16:17 UTC, about 26 hours after the GitHub Advisory Database indexed the vulnerability. The attacker went straight for litellm_credentials.credential_values and litellm_config, the tables that store upstream provider keys. No probes against user tables or team tables. They knew exactly what they wanted.

Twenty minutes later, the same operator switched to a different IP (65.111.25[.]67) and ran more precise queries, this time with correct table names and column counts derived from the first pass. Fewer payloads, better targeting.

The fix shipped in LiteLLM 1.83.7 on April 19, replacing string concatenation with parameterized queries. But the advisory didn’t hit the global GitHub Advisory Database until later, and that gap between patch availability and public disclosure is where the damage window opens.

The blast radius here is ugly. A single row in litellm_credentials can contain an OpenAI org key with a five-figure monthly spend cap, an Anthropic console key with workspace admin rights, and an AWS Bedrock IAM credential. Sysdig described the impact as closer to a cloud-account compromise than a typical web-app SQL injection. They are not wrong.

This is the same LiteLLM project that got hit by a supply chain attack last month. TeamPCP compromised the maintainer’s PyPI credentials via a poisoned Trivy GitHub Action in the CI/CD pipeline and pushed backdoored versions 1.82.7 and 1.82.8. Those packages deployed a three-stage credential stealer. One project, two major security incidents in five weeks.

The pattern is becoming familiar for AI infrastructure software. Critical, pre-auth, and in software with five-figure GitHub star counts that operators trust to centralize cloud-grade credentials. Langflow got the same treatment earlier this month. LMDeploy was exploited within 13 hours of disclosure. The Zero Day Clock keeps ticking down.

If you run LiteLLM, upgrade to 1.83.7 or later immediately. Every virtual API key, master key, and provider credential on internet-exposed instances should be considered compromised and rotated. For those who cannot upgrade right now, setting disable_error_logs: true under general_settings removes the path untrusted input uses to reach the vulnerable query.

The 88% figure for unpatched GitHub Enterprise Server instances from the CVE-2026-3854 disclosure yesterday is a reminder that “patch available” and “patch applied” are very different things.

Sources: BleepingComputer, The Hacker News, Sysdig, LiteLLM Advisory