NewsCompaniesFlawsGuides
Get the app
CriticalFixedBeing used in attacksClosedUpdated

LiteLLM Proxy SQL injection CVE-2026-42208 used in attacks; fixed in 1.83.7

Attackers targeted LiteLLM AI gateways through CVE-2026-42208, which can expose database contents and managed credentials without a login. Versions 1.81.16–1.83.6 are affected. Update to 1.83.7 or later and investigate exposed installations.

What to do

If your business or family office runs LiteLLM, ask its IT team to update to a current stable release containing the fix introduced in 1.83.7. If an affected installation was internet-accessible, have them review database activity and replace its virtual API keys, master key and stored provider credentials. There is no phone or browser update for ordinary users to install for this flaw.

What’s happening

LiteLLM Proxy, an AI gateway used to connect applications to model providers, had a flaw in its API key checks that allowed attackers without a login to read its database and potentially alter it. This could expose credentials managed by the gateway. BerriAI identifies versions 1.81.16–1.83.6 as affected and 1.83.7 and later as fixed, with a stable release available before its 20 April advisory. Sysdig observed targeted attempts on 26 April against tables holding keys, provider credentials and configuration, but did not confirm a successful compromise in that activity. CISA listed the flaw as exploited on 8 May. The fix remains available; the reviewed sources do not establish whether attacks are still continuing. Previously exposed installations also need investigation and credential replacement.

What
Flaw
Affects
BerriAI LiteLLM Proxy AI gateway
Affected
LiteLLM Proxy >=1.81.16, <1.83.7
Fixed in
LiteLLM 1.83.7 and later
LiteLLM v1.83.7-stable
CVE
CVE-2026-42208
Since
8 May 2026
Closed
8 May 2026

Timeline

  1. CISA added

    CISA added CVE-2026-42208 to its Known Exploited Vulnerabilities catalogue, with a remediation deadline of 11 May for US federal civilian agencies, as recorded by Uganda's national CERT.

  2. Update

    LiteLLM confirmed that a stable fix preceded disclosure and recommended v1.83.10-stable, while accepting any version from 1.83.7. It advised reviewing PostgreSQL query history where affected installations had been reachable from untrusted networks.

  3. Wider attacks

    Sysdig observed targeted attack attempts against database tables holding API keys, provider credentials and configuration, 36 hours and seven minutes after global indexing. It did not establish a successful compromise or observe subsequent use of stolen credentials.

  4. Update

    The advisory entered the global GitHub Advisory Database, according to Sysdig. This was four days after publication in LiteLLM's own repository.

  5. Made public

    BerriAI published its advisory for SQL injection in LiteLLM Proxy's API key checks. Versions 1.81.16 through 1.83.6 are affected; 1.83.7 and later are fixed.

  6. New fixFixed

    BerriAI released LiteLLM v1.83.7-stable, the release identified in its security advisory as fixing this flaw.

Sources

  1. SQL injection in Proxy API key verificationBerriAI · 20 Apr 2026
  2. Release v1.83.7-stableBerriAI · 19 Apr 2026
  3. Security Update: CVE-2026-42208 in LiteLLM ProxyLiteLLM · 29 Apr 2026
  4. Bug 2463965: LiteLLM unauthorised data access and modification via SQL injectionRed Hat · 29 Apr 2026
  5. CVE-2026-42208: Targeted SQL injection against LiteLLM's authentication path discovered 36 hours following vulnerability disclosureSysdig · 27 Apr 2026
  6. Hackers are exploiting a critical LiteLLM pre-auth SQLi flawBleepingComputer · 28 Apr 2026
  7. LiteLLM Pre-Authentication SQL Injection – Added to CISA KEV (CVE-2026-42208)Uganda National CERT · 11 May 2026
HARD Live follows this until it’s over: each change is added to the timeline with its source. Everything live · Everything from May 2026 · JSON · RSS