CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

LiteLLM Proxy pre-auth SQL injection, all upstream LLM API keys at risk (CVSS 9.3, KEV deadline 2026-05-11)

cve · CVE-2026-42208

Coverage
1
first 2026-05-09 → last 2026-10-21
Latest activity
2026-05-09
LiteLLM SQL injection: attackers targeted stored credentials 36 hours after disclosure; patching does not…
Peak priority
high
1 high
Targets
·
no sector or region stated
Sources cited
5
5 hosts

Action items (1)

Do-now tasks recorded on the entries about CVE-2026-42208, newest first. Check the date before acting on an older one.

  • On any LiteLLM Proxy that ran 1.81.16 to 1.83.6 reachable from untrusted networks, upgrade to 1.83.7 or later and rotate the upstream provider keys and virtual keys stored in its database.
    2026-05-09CVE-2026-42208

Defender insights

What each entry about CVE-2026-42208 tells a defender to do, newest first.

2026-05-09HIGHexploitedLiteLLM SQL injection: attackers targeted stored credentials 36 hours after disclosure; patching does not undo exposure

Exposure · detection

Story timeline

  1. 2026-05-09CVE-2026-42208: LiteLLM Proxy pre-authentication SQL injection in API-key verification, first exploitation attempt 36 hours after the advisory, CISA KEV-listed (CVSS 4.0 9.3)
    trending-vulnerabilitiesLiteLLM SQL injection: attackers targeted stored credentials 36 hours after disclosure; patching does not undo exposure

Hunting pivots

Affected products
LiteLLM Proxy
Tags
actively-exploitedai-abusecisa-kevcloudpatch-availablepre-authvulnerabilities
ATT&CK techniques (2 across 2 tactics)

2 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessExploit Public-Facing Application
  • Credential AccessUnsecured Credentials

Initial Access TA0001

T1190Exploit Public-Facing Application×1

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-05-09/cve-2026-42208-litellm-proxy-pre-authentication-sql-injectio · ATT&CK page ↗

Credential Access TA0006

T1552Unsecured Credentials×1

Adversaries may search compromised systems to find and obtain insecurely stored credentials. These credentials can be stored and/or misplaced in many locations on a system, including plaintext files (e.g. Shell History), operating system or application-specific repositories (e.g. Credentials in Registry), or other specialized files/artifacts (e.g. Private Keys).

Evidence: 2026-05-09/cve-2026-42208-litellm-proxy-pre-authentication-sql-injectio · ATT&CK page ↗

Entries about LiteLLM Proxy pre-auth SQL injection, all upstream LLM API keys at risk (CVSS 9.3, KEV deadline 2026-05-11) (1)

2026-05-09 · view entry permalink →

HIGHCVE-2026-42208exploitedupdatedNATOA2

CVE-2026-42208: LiteLLM Proxy pre-authentication SQL injection in API-key verification, first exploitation attempt 36 hours after the advisory, CISA KEV-listed (CVSS 4.0 9.3)

LiteLLM's advisory GHSA-r75f-5x8p-qvmc, published on 2026-04-20, describes a SQL injection in the proxy's API-key verification: the caller-supplied value was not passed to the database as a separate parameter, and the flaw is fixed in 1.83.7 (LiteLLM, 2026-04-20). Bishop Fox confirmed that versions 1.81.16 through 1.83.6 are exploitable without credentials from any LLM API route, through the Authorization: Bearer value reaching PrismaClient.get_data(); the response is always the same HTTP 401, so exploitation runs over a time-based blind channel using PostgreSQL's pg_sleep() (Bishop Fox, 2026-05-06). On a stock Docker Compose deployment with the Postgres sidecar, the application database user is a superuser, which raises the impact beyond reading metadata (Bishop Fox, 2026-05-06). Virtual keys are stored as SHA-256 hashes, but the provider credentials are stored for use (Bishop Fox, 2026-05-06) (Sysdig, 2026-04-27).

Sysdig observed the first exploitation attempt 36 hours and seven minutes after the advisory reached the global database, with queries against LiteLLM_VerificationToken (virtual keys, including the master key), litellm_credentials (stored upstream provider credentials) and litellm_config (Sysdig, 2026-04-27). Sysdig saw no follow-through: no authenticated calls with exfiltrated keys, no virtual-key minting through /key/generate and no reuse of provider credentials, so its finding is the speed and precision of the enumeration rather than a confirmed compromise; it still advises treating any internet-facing instance on a vulnerable version as compromised (Sysdig, 2026-04-27). CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2026-05-08 (CISA KEV catalog, 2026-05-08). The published workaround, general_settings.disable_error_logs: true, closes only one of the two code paths that reach the vulnerable query (Bishop Fox, 2026-05-06).

The Sysdig Threat Research Team (TRT) observed the first exploitation attempt 36 hours and seven minutes after the advisory was published to the global database.

The novelty of this finding is the speed and precision of the schema-enumeration attempt, not a confirmed compromise.

Sysdig 2026-04-27
Correctionrun 2026-10-11T1307Z-audittitleheadlinesummaryevent_datetagscvesaffected_productstechniquessourcesevidencesourcing_noteclassificationactionsbody

Sysdig, not Bishop Fox or LiteLLM, reported the attackers' queries against LiteLLM_VerificationToken, litellm_credentials and litellm_config, and the first attempt came 36 hours and seven minutes after the advisory (Sysdig, 2026-04-27); no source gives 26 hours. The flaw is a SQL injection in the key lookup (LiteLLM, 2026-04-20), and Bishop Fox's analysis is dated 2026-05-06 (Bishop Fox, 2026-05-06).

Improvementrun 2026-10-21T1149Z-audittitlesummarybodyevidenceheadline

Sysdig's observation was an exploitation attempt without follow-through: it saw no authenticated calls with exfiltrated keys, no virtual-key minting through /key/generate and no reuse of provider credentials, and calls its finding "the speed and precision of the schema-enumeration attempt, not a confirmed compromise" (Sysdig, 2026-04-27). Sysdig still advises treating any internet-facing instance on a vulnerable version as compromised and rotating every virtual key, master key and provider credential it stores (Sysdig, 2026-04-27).

vulnerability09 May 05:00Zmulti-sourceOpen finding →
Sources: LiteLLM (BerriAI) · Sysdig · Bishop Fox · LiteLLM · CISA KEV catalog

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Vulns1

Source distribution

  • bishopfox.com1 (20%)
  • cisa.gov1 (20%)
  • docs.litellm.ai1 (20%)
  • github.com1 (20%)
  • sysdig.com1 (20%)

External references

NVD · cve.org · CISA KEV

All cited sources (5)