Summary
Critical SQL Injection Flaw Threatens LiteLLM Security
The CVE-2026-42208 SQL injection vulnerability represents a critical security flaw in BerriAI LiteLLM, an open-source LLM gateway used to manage API access to large language models. This SQL injection vulnerability enables attackers to extract sensitive data directly from LiteLLM backend databases with minimal effort and no authentication required. The LiteLLM vulnerability affects versions 1.81.16 through 1.83.6, exposing organizations to significant credential theft risks.
Active exploitation of the LiteLLM SQL injection flaw was detected within days of its disclosure on April 20, 2026. Threat actors are leveraging weaknesses in the API key verification process to inject malicious SQL queries through specially crafted Authorization headers. Observed attack patterns show sophisticated targeting of critical database tables containing API keys, master keys, upstream provider credentials (OpenAI, Anthropic, AWS Bedrock), and environment configuration data. Attackers demonstrate advanced knowledge of LiteLLM's internal database structure, employing UNION-based SQL queries and schema enumeration techniques to refine their data extraction capabilities.
The SQL injection vulnerability in LiteLLM poses an immediate threat to organizations running exposed instances, as attackers can access authentication credentials without any user interaction. Security researchers strongly recommend treating all internet-accessible LiteLLM instances running vulnerable versions as compromised. Immediate patching to version 1.83.7 and complete rotation of all stored credentials is essential to prevent unauthorized access to downstream LLM provider accounts and potential data exfiltration.
Vulnerability Details
Understanding the CVE-2026-42208 SQL Injection Vulnerability
The CVE-2026-42208 vulnerability is a critical SQL injection flaw affecting the BerriAI LiteLLM open-source LLM gateway. This SQL injection vulnerability, classified under CWE-89, originates from improper handling of API key verification within the LiteLLM proxy. During the authentication process, the Bearer token extracted from the Authorization header is directly inserted into PostgreSQL queries without proper parameterization. This fundamental security weakness allows attackers to manipulate SQL queries by inserting a simple quote character, enabling execution of arbitrary SQL commands against the LiteLLM database.
Exploitation Requirements and Attack Surface
The LiteLLM SQL injection vulnerability is particularly dangerous due to its minimal exploitation requirements. Attackers do not need authentication credentials or user interaction to exploit CVE-2026-42208. A threat actor simply needs to send a specially crafted HTTP request to any accessible LiteLLM proxy endpoint, such as /chat/completions, with a malicious payload embedded in the Authorization header. The SQL injection is triggered when the malformed API key fails validation, allowing the attacker's payload to execute through the proxy's error-handling logic. This makes the LiteLLM vulnerability highly accessible to attackers scanning for vulnerable instances.
Targeted Data Extraction Techniques
Security researchers have observed sophisticated attack patterns targeting the LiteLLM SQL injection vulnerability. Attackers utilize UNION SELECT statements and other advanced SQL injection techniques to extract data from critical database tables within LiteLLM instances. Primary targets include the LiteLLM_VerificationToken table, which stores API keys including the master key, as well as litellm_credentials and litellm_config tables containing upstream provider credentials for services like OpenAI, Anthropic, and AWS Bedrock. Attackers also employ column enumeration techniques to understand the database structure, dynamically adjusting SQL injection payloads to maximize data extraction efficiency.
Timeline and Active Exploitation
The LiteLLM SQL injection vulnerability CVE-2026-42208 was publicly disclosed on April 20, 2026. Exploitation attempts against vulnerable LiteLLM instances were detected within days of disclosure, demonstrating rapid weaponization of the vulnerability. Security researchers traced attack activity to specific infrastructure showing coordinated exploitation efforts using consistent tooling and Python-based request patterns. The speed and precision of these attacks indicate that threat actors possess a clear understanding of the vulnerability's value and LiteLLM's internal architecture. While confirmed post-exploitation activity has not been publicly reported, the sophistication of observed attempts suggests exposed LiteLLM instances should be considered compromised.
Recommendations
Immediate Patch Deployment for LiteLLM Instances
Organizations must immediately upgrade all LiteLLM proxy instances to version 1.83.7 or later to remediate the CVE-2026-42208 SQL injection vulnerability. The patched LiteLLM release replaces vulnerable string interpolation with parameterized queries, eliminating the SQL injection vector in the API key verification process. Internet-facing LiteLLM instances require highest priority patching given confirmed active exploitation within hours of vulnerability disclosure. Delayed patching leaves organizations exposed to credential theft and unauthorized access to backend LLM provider accounts.
Implement Interim Security Controls
If immediate patching of LiteLLM instances is not feasible, organizations should implement interim workarounds to reduce SQL injection risk. Configure "disable_error_logs: true" under "general_settings" in the LiteLLM configuration to remove the vulnerable code path that allows unauthenticated input to reach the SQL query. Additionally, deploy a reverse proxy in front of LiteLLM instances that blocks Authorization header values containing single quotes, parentheses, SQL keywords (UNION, SELECT, FROM, OR), and SQL comment delimiters. These measures provide temporary protection but should not replace prompt patching.
Comprehensive Credential Rotation
Treat the database of any internet-accessible LiteLLM instance running vulnerable versions as compromised, even without confirmed data extraction. Immediately rotate every virtual API key, master key, and upstream provider credential stored in the LiteLLM proxy, including credentials for OpenAI, Anthropic, AWS Bedrock, and other LLM providers. Revoke and regenerate all affected credentials at the provider level to prevent unauthorized use. Credential rotation is essential because the SQL injection vulnerability allows extraction of sensitive authentication data that could enable persistent unauthorized access to LLM services.
Audit Upstream Provider Access
Review upstream LLM provider billing dashboards and API access logs for suspicious /chat/completions traffic originating from unfamiliar IP addresses during the vulnerability exposure window. Master key reuse from unexpected source IP addresses serves as the most reliable indicator of credential monetization following successful SQL injection exploitation. Organizations should investigate any anomalous usage patterns and correlate them with known indicators of compromise to assess potential data exfiltration or unauthorized LLM API usage.
Restrict Network Exposure
Move LiteLLM proxy instances behind internal network boundaries or deploy them behind mutually authenticated reverse proxies. AI gateways like LiteLLM consolidate significant credential value, making direct internet exposure a high-risk configuration. Ensure that port 4000 (or the configured LiteLLM listening port) is not publicly accessible without additional access controls. Implementing network segmentation and access controls reduces the attack surface and limits potential SQL injection exploitation to authenticated internal users.
Indicators of Compromise (IoCs)
Network Indicators
IPv4 Addresses:
- 65[.]111[.]27[.]132
- 65[.]111[.]25[.]67
These IP addresses have been associated with active exploitation attempts targeting the CVE-2026-42208 SQL injection vulnerability in LiteLLM instances. Organizations should monitor logs for connections from these addresses and investigate any related activity for potential credential theft or data exfiltration.
MITRE ATT&CK TTPs
Initial Access
T1190: Exploit Public-Facing Application - Attackers exploit the SQL injection vulnerability in internet-facing LiteLLM proxy instances to gain initial access to backend databases without authentication.
Credential Access
T1552: Unsecured Credentials T1552.001: Credentials In Files - Threat actors use SQL injection to extract API keys, master keys, and provider credentials stored in LiteLLM database tables, accessing credentials that are unsecured against SQL injection attacks.
Collection
T1005: Data from Local System - Attackers collect sensitive data including API keys, configuration details, and provider credentials directly from the LiteLLM database using SQL injection queries.
Discovery
T1082: System Information Discovery - Threat actors perform database schema enumeration through SQL injection to discover table structures, column names, and data organization within LiteLLM instances.
Resource Development
T1588: Obtain Capabilities T1588.006: Vulnerabilities - Attackers leverage the publicly disclosed CVE-2026-42208 vulnerability as a capability to compromise LiteLLM instances and extract valuable credentials.
References
- GitHub Security Advisory: https://github.com/BerriAI/litellm/security/advisories/GHSA-r75f-5x8p-qvmc
- LiteLLM Patch Release: https://github.com/BerriAI/litellm/releases/tag/v1.83.7-stable
- Sysdig Analysis: https://webflow.sysdig.com/blog/cve-2026-42208-targeted-sql-injection-against-litellms-authentication-path-discovered--hours-following-vulnerability-disclosure
