LiteLLM SQL Injection Flaw — A Critical Reminder for AI Infrastructure Security

Overview A critical vulnerability in LiteLLM, tracked as CVE‑2026‑42208, is being actively exploited by attackers. The flaw is a pre‑authentication SQL injection bug in LiteLLM’s proxy API key verification step, allowing adversaries to read and modify sensitive data in the proxy’s database without credentials.

What Happened

• Vulnerability: SQL injection via crafted Authorization: Bearer headers sent to LLM API routes.
• Impact: Unauthorized access to LiteLLM’s database, exposing API keys, master keys, provider credentials (OpenAI, Anthropic, Bedrock), and environment configs.
• Fix: Released in LiteLLM v1.83.7, replacing unsafe string concatenation with parameterized queries.
• Exploitation Timeline: Attacks began 36 hours after disclosure on April 24, 2026.

Why It Matters

LiteLLM is a widely used open‑source proxy/SDK middleware with 45k GitHub stars and 7.6k forks, powering many LLM apps and platforms.

• Credential Exposure: Stolen keys can be leveraged to impersonate services or launch downstream attacks.
• Supply Chain Risk: LiteLLM was recently targeted in a PyPI supply‑chain attack, showing adversaries are actively hunting this ecosystem.
• Targeted Exploitation: Attackers skipped benign tables and went straight for secrets, indicating prior knowledge of LiteLLM’s schema.

Defensive Guidance

• Upgrade Immediately: Move to LiteLLM v1.83.7 or later.
• Rotate Credentials: Treat all API keys, master keys, and provider credentials in exposed instances as compromised.
• Workaround: If upgrading isn’t possible, set disable_error_logs: true under general_settings to block malicious inputs from reaching vulnerable queries.
• Monitor Logs: Watch for suspicious crafted requests to /chat/completions with unusual Authorization headers.
• Harden Exposure: Avoid exposing LiteLLM instances directly to the internet without protective controls.

Final Thought

This incident underscores a broader truth: AI infrastructure is now a prime target for attackers. As organizations increasingly rely on LLM gateways and middleware, securing these components is just as critical as securing the models themselves. SQL injection may be an old attack vector, but in the context of AI proxies managing sensitive credentials, it becomes a high‑impact vulnerability with cascading risks.