LiteLLM · 2026-04-29 · major
LiteLLM CVE-2026-42208 — Critical SQL Injection in AI Gateway Exploited Within 36 Hours of Disclosure
Unauthenticated SQL injection in LiteLLM's API key validation (CVSS 9.3) dumped OpenAI, Anthropic, and AWS Bedrock credentials from any exposed gateway. Patched April 19; first exploit 36 hours after advisory — with schema-aware payloads targeting credential tables.
A critical SQL injection in the most popular open-source AI gateway let attackers steal every LLM API key stored in the database.
What is it?
CVE-2026-42208 is a CVSS 9.3 SQL injection in LiteLLM (versions before 1.83.7-stable) affecting the API key validation logic in its routing layer.
How does it work?
LiteLLM concatenated the user-supplied Authorization header directly into SQL queries without parameterization. Remote, unauthenticated attackers could send a crafted bearer token to endpoints like POST /chat/completions, extract the full litellm_credentials table, and harvest all stored LLM provider API keys (OpenAI, Anthropic, AWS Bedrock, and others), plus runtime configuration.
Why does it matter?
LiteLLM is used by thousands of enterprises as their AI gateway, aggregating keys for multiple providers. A single exploit grants access to 'an entire cloud account's worth of credentials.' The first exploitation in the wild occurred April 26 — just 26-36 hours after the GitHub advisory was indexed — with attackers targeting specific credential tables indicating prior knowledge of LiteLLM's schema.
Who is it for?
Any team running LiteLLM as an AI proxy must immediately upgrade to 1.83.7-stable or higher and rotate all API keys stored in the database.