CVE-2026-42208: Pre-Auth SQL Injection in LiteLLM Actively Exploited — AI API Keys at Risk

CVE-2026-42208 is a pre-authentication SQL injection in LiteLLM — the open-source LLM proxy with 22,000+ GitHub stars used by thousands of teams as a unified gateway to OpenAI, Anthropic, AWS Bedrock, and other providers. CVSS score: 9.3. Active exploitation started 36 hours after public disclosure.

Patch now: pip install litellm==1.83.7

What the Vulnerability Allows

The flaw lives in LiteLLM’s authentication path. A database query during proxy API key checks mixed the caller-supplied key value directly into the SQL query string instead of using a parameterized statement. A classic injection bug in a place where the consequences are anything but classic.

An unauthenticated attacker sends a crafted Authorization header to any LLM API route — for example, POST /chat/completions — and reaches the vulnerable query through the proxy’s error-handling path. No account required. No prior access needed.

From there, the attacker can read and potentially modify the litellm_credentials and litellm_config tables. These tables typically hold:

• OpenAI organization keys with five-figure monthly spend caps
• Anthropic console keys with workspace admin rights
• AWS Bedrock IAM credentials

Sysdig’s threat research team summarized the impact bluntly: “The blast radius of a successful database extraction is closer to a cloud-account compromise than a typical web-app SQL injection.” Attackers targeting active exploits have focused specifically on litellm_credentials.credential_values and litellm_config — the tables that hold upstream provider keys and runtime configuration.

Affected Versions

Vulnerable: LiteLLM 1.81.16 through 1.83.6 (inclusive)

Fixed: Version 1.83.7-stable, released April 19, 2026

What to Do Right Now

1. Upgrade immediately:

   pip install litellm==1.83.7

2. If you cannot patch immediately: Add disable_error_logs: true under general_settings in your LiteLLM config file. This removes the error-handling path that exposes the vulnerable query.

3. Rotate all credentials stored in your LiteLLM proxy database. Assume any deployment running versions 1.81.16–1.83.6 that was internet-accessible is compromised until proven otherwise.

4. Audit API key usage with OpenAI, Anthropic, and AWS Bedrock for anomalous calls over the past week. Provider dashboards for each show per-key usage history.

Why This Is Different From a Typical Web SQLi

Most SQL injection vulnerabilities hit application data — user records, session tokens, application state. This one hits the credential store for every AI provider your organization uses. A compromised OpenAI organization key with workspace-level access doesn’t just expose one application; it exposes every project, every fine-tune, every Batch API job attached to that account.

Teams that run LiteLLM as a self-hosted proxy specifically to avoid storing AI provider keys in multiple application codebases have centralized that risk into a single point. This vulnerability exploits exactly that consolidation.

If your LiteLLM instance was internet-facing on any version between 1.81.16 and 1.83.6 at any point since April 19, treat the credential rotation as mandatory, not precautionary.