{"id":"litellm-sql-injection-attacks-apr-2026","category":"patch","status":"closed","title":"LiteLLM Proxy SQL injection CVE-2026-42208 used in attacks; fixed in 1.83.7","tldr":"Attackers targeted LiteLLM AI gateways through CVE-2026-42208, which can expose database contents and managed credentials without a login. Versions 1.81.16–1.83.6 are affected. Update to 1.83.7 or later and investigate exposed installations.","summary":"LiteLLM Proxy, an AI gateway used to connect applications to model providers, had a flaw in its API key checks that allowed attackers without a login to read its database and potentially alter it. This could expose credentials managed by the gateway. BerriAI identifies versions 1.81.16–1.83.6 as affected and 1.83.7 and later as fixed, with a stable release available before its 20 April advisory. Sysdig observed targeted attempts on 26 April against tables holding keys, provider credentials and configuration, but did not confirm a successful compromise in that activity. CISA listed the flaw as exploited on 8 May. The fix remains available; the reviewed sources do not establish whether attacks are still continuing. Previously exposed installations also need investigation and credential replacement.","action":"If your business or family office runs LiteLLM, ask its IT team to update to a current stable release containing the fix introduced in 1.83.7. If an affected installation was internet-accessible, have them review database activity and replace its virtual API keys, master key and stored provider credentials. There is no phone or browser update for ordinary users to install for this flaw.","product":"BerriAI LiteLLM Proxy AI gateway","audience":"work","severity":"critical","patch":"patched","exploited":true,"cves":["CVE-2026-42208"],"tags":["berriai","litellm","ai-gateway","sql-injection","credential-theft","actively-exploited"],"affected":["LiteLLM Proxy >=1.81.16, <1.83.7"],"fixed":["LiteLLM 1.83.7 and later","LiteLLM v1.83.7-stable"],"matches":[],"sources":[{"kind":"advisory","title":"SQL injection in Proxy API key verification","url":"https://github.com/BerriAI/litellm/security/advisories/GHSA-r75f-5x8p-qvmc","by":"BerriAI","date":"2026-04-20"},{"kind":"post","title":"Release v1.83.7-stable","url":"https://github.com/BerriAI/litellm/releases/tag/v1.83.7-stable","by":"BerriAI","date":"2026-04-19"},{"kind":"post","title":"Security Update: CVE-2026-42208 in LiteLLM Proxy","url":"https://docs.litellm.ai/blog/cve-2026-42208-litellm-proxy-sql-injection","by":"LiteLLM","date":"2026-04-29"},{"kind":"advisory","title":"Bug 2463965: LiteLLM unauthorised data access and modification via SQL injection","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2463965","by":"Red Hat","date":"2026-04-29"},{"kind":"research","title":"CVE-2026-42208: Targeted SQL injection against LiteLLM's authentication path discovered 36 hours following vulnerability disclosure","url":"https://www.sysdig.com/blog/cve-2026-42208-targeted-sql-injection-against-litellms-authentication-path-discovered-36-hours-following-vulnerability-disclosure","by":"Sysdig","date":"2026-04-27"},{"kind":"news","title":"Hackers are exploiting a critical LiteLLM pre-auth SQLi flaw","url":"https://www.bleepingcomputer.com/news/security/hackers-are-exploiting-a-critical-litellm-pre-auth-sqli-flaw/","by":"BleepingComputer","date":"2026-04-28"},{"kind":"advisory","title":"LiteLLM Pre-Authentication SQL Injection – Added to CISA KEV (CVE-2026-42208)","url":"https://cert.ug/litellm-pre-authentication-sql-injection-added-cisa-kev-cve-2026-42208","by":"Uganda National CERT","date":"2026-05-11"}],"started":"2026-05-08","closed":"2026-05-08","created":"2026-11-03T22:21:59.232Z","updated":"2026-11-03T22:21:59.232Z","cve_notes":[{"cve":"CVE-2026-42208","name":"SQL injection in LiteLLM Proxy API key checks","what":"LiteLLM Proxy incorrectly incorporates untrusted input into a database query during API key checks, allowing an attacker without a login to read and potentially change database contents, including managed credentials.","severity":"critical","cvss":9.3}],"timeline":[{"at":"2026-05-08","added":"2026-11-03T22:11:23.504Z","kind":"cisa-added","text":"CISA added CVE-2026-42208 to its Known Exploited Vulnerabilities catalogue, with a remediation deadline of 11 May for US federal civilian agencies, as recorded by Uganda's national CERT.","url":"https://cert.ug/litellm-pre-authentication-sql-injection-added-cisa-kev-cve-2026-42208","by":"Uganda National CERT","patch":null},{"at":"2026-04-29","added":"2026-11-03T22:11:23.504Z","kind":"other","text":"LiteLLM confirmed that a stable fix preceded disclosure and recommended v1.83.10-stable, while accepting any version from 1.83.7. It advised reviewing PostgreSQL query history where affected installations had been reachable from untrusted networks.","url":"https://docs.litellm.ai/blog/cve-2026-42208-litellm-proxy-sql-injection","by":"LiteLLM","patch":null},{"at":"2026-04-26T04:24Z","added":"2026-11-03T22:11:23.504Z","kind":"wider-attacks","text":"Sysdig observed targeted attack attempts against database tables holding API keys, provider credentials and configuration, 36 hours and seven minutes after global indexing. It did not establish a successful compromise or observe subsequent use of stolen credentials.","url":"https://www.sysdig.com/blog/cve-2026-42208-targeted-sql-injection-against-litellms-authentication-path-discovered-36-hours-following-vulnerability-disclosure","by":"Sysdig","patch":null},{"at":"2026-04-24T16:17Z","added":"2026-11-03T22:11:23.504Z","kind":"other","text":"The advisory entered the global GitHub Advisory Database, according to Sysdig. This was four days after publication in LiteLLM's own repository.","url":"https://www.sysdig.com/blog/cve-2026-42208-targeted-sql-injection-against-litellms-authentication-path-discovered-36-hours-following-vulnerability-disclosure","by":"Sysdig","patch":null},{"at":"2026-04-20","added":"2026-11-03T22:11:23.504Z","kind":"disclosed","text":"BerriAI published its advisory for SQL injection in LiteLLM Proxy's API key checks. Versions 1.81.16 through 1.83.6 are affected; 1.83.7 and later are fixed.","url":"https://github.com/BerriAI/litellm/security/advisories/GHSA-r75f-5x8p-qvmc","by":"BerriAI","patch":null},{"at":"2026-04-19","added":"2026-11-03T22:11:23.504Z","kind":"new-fix","text":"BerriAI released LiteLLM v1.83.7-stable, the release identified in its security advisory as fixing this flaw.","url":"https://github.com/BerriAI/litellm/releases/tag/v1.83.7-stable","by":"BerriAI","patch":"patched"}],"url":"https://hard.fyi/live/litellm-sql-injection-attacks-apr-2026/","json":"https://hard.fyi/api/live?id=litellm-sql-injection-attacks-apr-2026"}