AI Sec Watch: A Security Intelligence Platform for AI Systems

Luu, T.J.

Hackers are exploiting a critical LiteLLM pre-auth SQLi flaw

highnewsLLM-Specific

security

Source: BleepingComputerApril 28, 2026

Summary

Hackers are actively exploiting CVE-2026-42208, a critical SQL injection flaw (a type of attack where malicious code is hidden in input to manipulate database queries) in LiteLLM, an open-source gateway that lets developers access multiple AI models through one interface. The vulnerability allows attackers to bypass authentication and steal sensitive data like API keys and credentials stored in the proxy's database, which they can then use to attack other systems.

Solution / Mitigation

LiteLLM released a fix in version 1.83.7 that replaces string concatenation with parameterized queries (a safer way to construct database queries). For users unable to upgrade immediately, maintainers suggest the workaround of setting 'disable_error_logs: true' under 'general_settings' to block the path through which malicious inputs can reach the vulnerable query. Additionally, organizations with exposed LiteLLM instances should rotate all virtual API keys, master keys, and provider credentials.