← Back to feed
2026-05-02 Supply Chain TLP:CLEAR

CVE-2026-42208: LiteLLM Pre-Auth SQL Injection Actively Exploited Within 26 Hours of Disclosure; Attackers Target Credential Storage

Date: 2026-05-02
Tags: supply-chain

Executive Summary

CVE-2026-42208 (CVSS 9.3) is an SQL injection that could be exploited to modify the underlying LiteLLM proxy database. The first exploitation attempt was recorded on April 26 at 16:17 UTC, roughly 26 hours and seven minutes after the GitHub advisory was indexed in the global GitHub Advisory Database. An unknown threat actor targeted database tables holding upstream LLM provider keys and proxy runtime environment secrets, suggesting the attacker was aware of and went after sensitive credential stores.

Campaign Summary

FieldDetail
Campaign / MalwareCVE-2026-42208 Post-Disclosure Exploitation
AttributionUnknown threat actor (confidence: low)
TargetOrganizations running externally exposed LiteLLM proxy instances with stored LLM API credentials
VectorUnauthenticated SQL injection via specially crafted Authorization header to any LLM API route, allowing attackers to read data from the proxy's database and potentially modify it, leading to unauthorized access to credentials.
Statusactive
First Observed2026-04-26

Detailed Findings

A database query used during proxy API key checks mixed the caller-supplied key value into the query text instead of passing it as a separate parameter. A fix was delivered in LiteLLM version 1.83.7 to replace string concatenation with parameterized queries. CVE-2026-42208 was exploited within 36 hours of disclosure, exposing LiteLLM credentials and risking cloud account compromise. In the second phase of the attack, the threat actor used a different IP address, this time abusing the access to run a similar probe. LiteLLM stores API keys, virtual and master keys, and environment/config secrets, so accessing its database allows hackers to read sensitive data they may then use to launch additional attacks.

MITRE ATT&CK Mapping

TechniqueIDContext
Exploit Public-Facing ApplicationT1190CVE-2026-42208 SQL injection exploited against externally accessible LiteLLM proxy endpoints
Credential Access via Exposed Cloud CredentialsT1526Attackers extract stored LLM API keys and cloud provider credentials from compromised proxy database

IOCs

Domains

_One attacker IP identified: 65.111.25.67; multiple probes observed with different IP addresses suggesting multi-stage reconnaissance._

Full URL Paths

_One attacker IP identified: 65.111.25.67; multiple probes observed with different IP addresses suggesting multi-stage reconnaissance._

Splunk Format

_No IOCs available for Splunk query_

Package Indicators

LiteLLM <1.83.7

Detection Recommendations

Monitor for SQL injection patterns in Authorization header payloads sent to LiteLLM API endpoints. Detection should focus on any LLM API routes receiving specially crafted Authorization headers with SQL syntax. Implement strict input validation on all API key verification paths. Monitor database access patterns for unusual queries targeting credential storage tables. Enable comprehensive logging of all database operations on LiteLLM proxy instances. Implement IP reputation blocking for scanning infrastructure.

References