BerriAI's LiteLLM proxy, an open-source gateway managing access to major LLM providers, suffered a critical SQL injection vulnerability that was exploited in the wild less than 36 hours after public disclosure. Tracked as CVE-2026-42208 (CVSS 9.3), the flaw allowed unauthenticated attackers to inject malicious SQL via the Authorization header on any LLM API route, such as POST /chat/completions. The root cause: a database query during API key checks concatenated the caller-supplied key value directly into the query string rather than using a parameterized binding. This error-path reach meant an attacker could read and potentially modify the proxy's internal database, including stored credentials for upstream services like OpenAI, Anthropic, and AWS Bedrock.
The vulnerability affects versions >=1.81.16 and <1.83.7. The fix shipped in version 1.83.7-stable on April 19, 2026. Sysdig recorded the first exploitation attempt on April 26 at 16:17 UTC, roughly 26 hours after the GitHub Advisory Database indexed the CVE. The attacker, operating from IP 65.111.27[.]132, specifically targeted tables `litellm_credentials.credential_values` and `litellm_config`, which hold provider API keys and runtime configuration. Notably, they ignored `litellm_users` and `litellm_team` tables, demonstrating precise knowledge of the schema. Twenty minutes later, a second IP (65.111.25[.]67) executed a similar probe, suggesting a coordinated operator.
Sysdig's analysis highlights the blast radius: a single credential row can contain an OpenAI org key with five-figure monthly spend limits, an Anthropic console key with workspace admin rights, and an AWS Bedrock IAM credential. This is closer to a cloud-account compromise than a typical web-app SQL injection. The incident follows last month's supply chain attack on LiteLLM by TeamPCP, underscoring the attack surface of high-star AI infrastructure projects.
For teams unable to patch immediately, maintainers recommend setting `disable_error_logs: true` under `general_settings` to remove the untrusted-input path to the vulnerable query. The 36-hour exploit window confirms that public advisories and open-source schemas now suffice for rapid weaponization, without waiting for a proof-of-concept.
Source: The Hackers News