LiteLLM CVE-2026-42208 SQL Injection Exploited within 36 Hours of Disclosure
Within 36 hours of being made public, a recently discovered significant security weakness in BerriAI's LiteLLM Python module has been actively exploited in the wild, demonstrating yet another example of threat actors jumping on the exploitation bandwagon.
The SQL injection vulnerability, identified as CVE-2026-42208 (CVSS score: 9.3), has the potential to alter the LiteLLM proxy database.
LiteLLM maintainers reported last week that a database query used for proxy API key checks combined the caller-supplied key value into the query text rather than delivering it as a separate parameter.
Any LLM API route (such as POST /chat/completions) may receive a specially constructed Authorization header from an unauthenticated attacker, who could then access this query via the proxy's error-...