CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

LiteLLM Proxy

product · product:litellm-proxy

Coverage
1
first 2026-05-09 → last 2026-10-11
Latest activity
2026-05-09
Attackers went straight for LiteLLM's stored provider credentials 36 hours after the SQL injection advisory…
Peak priority
high
1 high
Targets
·
no sector or region stated
Sources cited
5
5 hosts

Action items (1)

Do-now tasks recorded on the entries about LiteLLM Proxy, newest first. Check the date before acting on an older one.

  • On any LiteLLM Proxy that ran 1.81.16 to 1.83.6 reachable from untrusted networks, upgrade to 1.83.7 or later and rotate the upstream provider keys and virtual keys stored in its database.
    2026-05-09CVE-2026-42208

Defender insights

What each entry about LiteLLM Proxy tells a defender to do, newest first.

2026-05-09HIGHexploitedAttackers went straight for LiteLLM's stored provider credentials 36 hours after the SQL injection advisory; patching does not undo an exposure

Exposure · detection

Story timeline

  1. 2026-05-09CVE-2026-42208: LiteLLM Proxy pre-authentication SQL injection in API-key verification, exploited 36 hours after the advisory, CISA KEV-listed (CVSS 4.0 9.3)
    trending-vulnerabilitiesAttackers went straight for LiteLLM's stored provider credentials 36 hours after the SQL injection advisory; patching does not undo an exposure

Hunting pivots

CVEs (exploited first)
CVE-2026-42208
Releases covered
LiteLLM Proxy
Tags
actively-exploitedai-abusecisa-kevcloudpatch-availablepre-authvulnerabilities
ATT&CK techniques (2 across 2 tactics)

2 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v19.2 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessExploit Public-Facing Application
  • Credential AccessUnsecured Credentials

Initial Access TA0001

T1190Exploit Public-Facing Application×1

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-05-09/cve-2026-42208-litellm-proxy-pre-authentication-sql-injectio · ATT&CK page ↗

Credential Access TA0006

T1552Unsecured Credentials×1

Adversaries may search compromised systems to find and obtain insecurely stored credentials. These credentials can be stored and/or misplaced in many locations on a system, including plaintext files (e.g. Shell History), operating system or application-specific repositories (e.g. Credentials in Registry), or other specialized files/artifacts (e.g. Private Keys).

Evidence: 2026-05-09/cve-2026-42208-litellm-proxy-pre-authentication-sql-injectio · ATT&CK page ↗

Entries about LiteLLM Proxy (1)

2026-05-09 · view entry permalink →

HIGHCVE-2026-42208exploitedupdatedNATOA2

CVE-2026-42208: LiteLLM Proxy pre-authentication SQL injection in API-key verification, exploited 36 hours after the advisory, CISA KEV-listed (CVSS 4.0 9.3)

LiteLLM's advisory GHSA-r75f-5x8p-qvmc, published on 2026-04-20, describes a SQL injection in the proxy's API-key verification: the caller-supplied value was not passed to the database as a separate parameter, and the flaw is fixed in 1.83.7 (LiteLLM, 2026-04-20). Bishop Fox confirmed that versions 1.81.16 through 1.83.6 are exploitable without credentials from any LLM API route, through the Authorization: Bearer value reaching PrismaClient.get_data(); the response is always the same HTTP 401, so exploitation runs over a time-based blind channel using PostgreSQL's pg_sleep() (Bishop Fox, 2026-05-06). On a stock Docker Compose deployment with the Postgres sidecar, the application database user is a superuser, which raises the impact beyond reading metadata (Bishop Fox, 2026-05-06). Virtual keys are stored as SHA-256 hashes, but the provider credentials are stored for use (Bishop Fox, 2026-05-06) (Sysdig, 2026-04-27).

Sysdig observed the first exploitation attempt 36 hours and seven minutes after the advisory reached the global database, with queries against LiteLLM_VerificationToken (virtual keys, including the master key), litellm_credentials (stored upstream provider credentials) and litellm_config (Sysdig, 2026-04-27). CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2026-05-08 (CISA KEV catalog, 2026-05-08). The published workaround, general_settings.disable_error_logs: true, closes only one of the two code paths that reach the vulnerable query (Bishop Fox, 2026-05-06).

The Sysdig Threat Research Team (TRT) observed the first exploitation attempt 36 hours and seven minutes after the advisory was published to the global database.

Sysdig 2026-04-27
Correctionrun 2026-10-11T1307Z-audittitleheadlinesummaryevent_datetagscvesaffected_productstechniquessourcesevidencesourcing_noteclassificationactionsbody

Sysdig, not Bishop Fox or LiteLLM, reported the attackers' queries against LiteLLM_VerificationToken, litellm_credentials and litellm_config, and the first attempt came 36 hours and seven minutes after the advisory (Sysdig, 2026-04-27); no source gives 26 hours. The flaw is a SQL injection in the key lookup (LiteLLM, 2026-04-20), and Bishop Fox's analysis is dated 2026-05-06 (Bishop Fox, 2026-05-06).

vulnerability09 May 05:00Zmulti-sourceOpen finding →
Sources: LiteLLM (BerriAI) · Sysdig · Bishop Fox · LiteLLM · CISA KEV catalog

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Vulns1

Source distribution

  • bishopfox.com1 (20%)
  • cisa.gov1 (20%)
  • docs.litellm.ai1 (20%)
  • github.com1 (20%)
  • sysdig.com1 (20%)
All cited sources (5)