CVE-2026-42208: The SQL Injection in LiteLLM That Hands Attackers Your AI Credentials

A pre-authentication flaw in LiteLLM's API key verification turns an AI proxy into an open vault. Exploitation was observed within 36 hours of disclosure. CISA has added it to the Known Exploited Vulnerabilities catalog.

Published: 2026-10-30  |  Last reviewed: 2026-10-30  |  CVE: CVE-2026-42208  |  CISA KEV  |  CVSS 9.8 Critical

LiteLLM is a popular open-source AI gateway that lets teams route API calls to more than 100 large language model providers through a single OpenAI-compatible interface. The architecture is convenient — one proxy, one set of virtual keys, one place to manage spend limits across providers. That convenience is also what made CVE-2026-42208 so immediately attractive to attackers.

The flaw is in the proxy's own key-validation logic. Before LiteLLM checks whether an incoming request carries a legitimate API key, it runs a database query. In affected versions, that query is built by pasting the caller-supplied bearer token directly into an SQL string — no sanitization, no parameterization. The fix, when it came, was a single commit described by its author as: "fix: refactor, race condition handle, fstring sql injection." [1]

What exactly is CVE-2026-42208?

LiteLLM describes itself as an AI gateway — a single endpoint that translates and forwards API calls to more than 100 LLM providers. That means the PostgreSQL database behind it doesn't just hold a few application records. It holds the upstream provider API keys — OpenAI, Azure, Anthropic, and others — alongside virtual keys, spend limits, and configuration data. A successful read of that database is, effectively, access to every AI service the organization has connected through LiteLLM. [2]

The root cause is a Python f-string interpolation issue in litellm/proxy/utils.py. When LiteLLM validates an API key, it looks up the key in a database view that aggregates multiple tables. The lookup function builds its SQL query using the raw bearer token value rather than a parameterized binding. A single quote in the bearer token is enough to break out of the string context and append arbitrary SQL. Bishop Fox researchers who independently reproduced the vulnerability described it as "a textbook example of an f-string SQL injection in an internal helper function reached through an exception path nobody thought of as a privileged context." [1]

Every standard LLM API route serves as a valid injection entry point — /v1/chat/completions, /v1/completions, /v1/messages, /v1/embeddings. None of them require authentication before the vulnerable validation step runs, which is why this is classified as pre-authentication.

How serious is it, and what do the scores actually mean?

The two scores reflect two different scoring frameworks rather than a disagreement about severity. CVSS 4.0 restructures how certain factors contribute to a score, which can shift numbers slightly compared to 3.1. Both assessments reach the same qualitative conclusion: Critical, with an extremely low exploitation bar. [3]

The EPSS score is worth noting separately: at the time of CISA KEV listing, multiple tracking sources placed CVE-2026-42208 in the 99th percentile for exploitation probability across all scored CVEs. That assessment proved accurate given the 36-hour window to first observed attack.

What did actual exploitation look like?

That distinction matters. A generic SQLmap spray against a newly published injection would probe targets semi-randomly. What Sysdig observed was different: the attacker went directly for the three tables most likely to contain high-value secrets — the tables storing virtual API keys, stored upstream provider credentials, and proxy configuration values. [4]

The exploitation sequence followed a recognizable pattern for UNION-based injection: progressively varying the column count (1, 2, 3, 5, 6 columns) until the output shape matched what the application would return, then using the confirmed shape to extract data. The final payload was an OR 1=1-- tautology — a fallback to "return any row if enumeration fails." Both source IPs used the same Python/aiohttp user-agent string and sat in adjacent address blocks of the same autonomous system, suggesting a single operator rotating egress IPs rather than two independent actors.

One important clarification: Sysdig documented enumeration attempts targeting LiteLLM's credential tables. The report does not confirm that a successful credential extraction or downstream account compromise was the outcome of those specific attempts. What was confirmed is that real exploitation attempts, deliberately targeting credential tables, occurred rapidly after public disclosure.

The Cloud Security Alliance noted in its research that two earlier incidents in 2026 had already involved LiteLLM's credential aggregation role, suggesting the platform had drawn adversarial attention before this CVE was even published. [5]

Why does this architecture make credential theft especially impactful?

Traditional SQL injection against a web application typically exposes user records or internal content. Against an AI proxy's credential store, the scope is different. A single successful query against the litellm_credentials.credential_values column can expose keys for OpenAI, Azure, Anthropic, and every other provider the team has configured — all in one read. [3]

This is why analysts described the downstream risk in terms of "LLMjacking" — using stolen LLM API credentials to run inference at the victim account's expense, accumulating significant billing before the victim notices. Whether that was the specific intent behind the observed April 2026 exploitation is not established in published reporting. It is the plausible downstream risk from credential theft of this kind.

Organizations running LiteLLM with multiple providers, or using it to centralize access for large engineering teams, face the most concentrated exposure. A single LiteLLM database can hold more AI provider credentials than a typical company's entire cloud key management system. For teams managing vulnerability management at scale, this is exactly the type of flaw that warrants immediate escalation — CISA KEV status, active exploitation, and a pre-auth attack vector are each independently sufficient reasons to treat it as an emergency patch.

How was the fix implemented?

The fix was released April 19, 2026 — one day before the GitHub Security Advisory was published on April 20. That sequence — fix first, advisory second — is the correct order for responsible disclosure. BerriAI currently recommends upgrading to 1.83.10-stable, which includes the fix plus subsequent stability improvements. [2]

If an immediate upgrade is not possible, placing a WAF in front of LiteLLM and blocking requests whose Authorization header contains SQL metacharacters provides partial mitigation — though WAF-based SQL injection filtering can be bypassed through encoding variations. Patching remains the correct remedy. Bishop Fox confirmed the patch fully eliminates the injection point. [1]

What should teams do now?

The remediation steps in order:

1. Check your version. Run pip show litellm or check your container image tag. Versions 1.81.16 through 1.83.6 are affected.
2. Upgrade. BerriAI's recommended version is 1.83.10-stable. The minimum fix is 1.83.7. [2]
3. Rotate credentials — all of them. Treat every key in the LiteLLM PostgreSQL database as potentially exposed. Revoke upstream provider keys at the provider level first, then regenerate. Rotating only in LiteLLM without revoking at the provider is insufficient — the provider has no visibility into whether LiteLLM has been patched.
4. Review logs for prior access. Check PostgreSQL slow query logs for UNION-based patterns or unusually high query counts from single IPs. Review provider spend dashboards for anomalies predating your patch date.
5. Harden network access. LiteLLM proxies with direct internet exposure are the highest-risk deployments. If your proxy should only be reachable from internal services, verify that network policies actually enforce this.

If your organization uses a zero trust architecture, this is a useful test of whether AI gateway workloads are subject to the same network policy controls as other sensitive credential stores. AI proxy components are often deployed quickly by development teams without the security review that applies to cloud IAM or secret managers — even when they hold equivalent access.

What remains uncertain

A few things are not established by current public reporting:

• Whether any of the exploitation attempts observed by Sysdig successfully extracted usable credentials, or whether those credentials were subsequently used for unauthorized inference or account actions.
• The total number of organizations affected prior to patching. Bitsight's footprint data shows observed instances across the US, China, Germany, Singapore, and elsewhere, but that does not represent confirmed compromise.
• Whether actors beyond the one observed by Sysdig conducted exploitation during the window between advisory publication and widespread patching.

What is confirmed: the vulnerability is real, independently reproduced by multiple research teams, exploitation was observed in the wild within 36 hours of advisory publication, and CISA's KEV listing reflects its assessment that real-world exploitation against real targets occurred.

Strategic implications

CVE-2026-42208 illustrates something specific about AI infrastructure security that goes beyond the mechanics of SQL injection: the aggregation risk in AI gateways is qualitatively different from traditional application credential risks.

When a company centralizes all its LLM API access through a single proxy, that proxy accumulates the value of every AI provider relationship the organization has. The convenience is real — unified billing, centralized key rotation, spend controls — but the security consequence is that the proxy's database becomes a high-priority target. The same architectural pattern that makes LiteLLM useful is what made this vulnerability immediately attractive to attackers who clearly understood the schema before the advisory was even widely read.

The security history of similar architectural chokepoints — API gateways, secret managers, SSO providers — suggests that any component positioned as a universal credential broker will receive disproportionate adversarial attention. The right response is not to avoid that architecture but to apply commensurate security scrutiny: treat AI proxy databases like secret manager stores, not like application databases. Patch them on emergency timelines. Put them behind network controls. Require credential rotation after any security event, not just confirmed compromise.

The 36-hour window from advisory to first observed attack is a useful baseline. The targeting behavior Sysdig observed — going straight for credential tables rather than running a generic scan — suggests actors with prior familiarity with LiteLLM's internal schema. That's a marker of sustained interest in the platform, not opportunistic scanning. For understanding how CVSS scores translate into real-world triage priority, a 9.8 CVSS alongside a KEV listing and a 36-hour exploitation window is about as unambiguous a signal as exists.