hypeorhack
← back

CVE-2026-42208

hype LIKELY HACK · 78 hack

Consistent multi-source reports of active exploitation, rapid weaponization timeline, and defender patch calls. KEV absence and missing NVD metadata reduce confidence slightly.

What: SQL injection in LiteLLM proxy (AI gateway) allowing unauthenticated database access to API keys for OpenAI, Anthropic, AWS and other upstream providers. CVSS/EPSS scores unavailable.

Why it matters: Social chatter consistently reports in-the-wild exploitation within 36 hours of public disclosure. Posts describe active weaponization targeting credential vaults in production AI infrastructure. Multiple security vendors and analysts flagging urgent patch requirement. No KEV listing evident in metadata, but defender urgency and rapid exploitation timeline are strong signals of real compromise activity.

Where it's seen: X and Bluesky posts from security researchers, vendor advisories, and threat intelligence accounts repeating near-identical "36 hours to exploitation" narrative. Framing emphasizes AI supply-chain risk and credential exposure severity.

RISK: CRITICAL — Unauthenticated SQL injection in widely-deployed AI proxy exfiltrating upstream API keys to production systems.

Generated by claude-haiku-4-5 from public posts and authoritative metadata. AI can make mistakes — verify against vendor advisories before acting. 5/2/2026, 12:14:21 AM

Public PoCs on GitHub 6 repos

Page 1 of 2

Articles & coverage 15 articles

  • Critical LiteLLM SQL Injection Vulnerability Exploited in the Wild

    # Critical LiteLLM SQL Injection Vulnerability Exploited in the Wild. A critical pre-authentication SQL injection vulnerability, tracked as CVE-2026-42208, has been discovered in the widely used LiteLLM gateway, exposing sensitive backend databases to unauthorized access. Security researchers have confirmed that threat actors are already actively exploiting this flaw to steal high-value secrets, i

  • CVE-2026-42208

    Vulmon Logo Vulmon Recent Vulnerabilities Research Posts Trends Blog Docs About Contact. # CVE-2026-42208. ## Vulnerability Summary. Hackers are exploiting a critical LiteLLM pre-auth SQLi flaw By Bill Toulas April 28, 2026 05:07 PM 0 Hackers are targeting sensitive information stored in the LiteLLM open-source large-language model (LLM) gateway by exploiting a critical vulnerability  tracked as

  • vLiteLLM CVE-2026-42208 SQL Injection Exploited

    **CVE-2026-42208** shows how quickly attackers now move against vulnerable AI infrastructure. The critical **SQL Injection** flaw in BerriAI’s **LiteLLM** Python package was exploited in the wild within about 36 hours of advisory publication. That means attackers moved before many DevOps teams, cloud security teams, and AI platform operators could even finish triage. Attackers targeted LiteLLM’s p

  • CVE-2026-42208: LiteLLM bug exploited 36 hours after its disclosure

    ## Attackers quickly exploited a critical LiteLLM flaw (CVE-2026-42208) to access and modify sensitive database data via SQL injection. The vulnerability, an SQL injection in the proxy API key verification process, lets attackers access and potentially modify database data. An unauthenticated attacker could send a specially crafted `Authorization` header to any LLM API route (for example `POST /ch

  • LiteLLM exploited within 36 hours of disclosure via SQL injection bug

    For the second time in five weeks, BerriAI’s LiteLLM Python package was exploited in the wild, this time within 36 hours of disclosure.In the latest exploit, a critical SQL injection bug — CVE-2026-42208 — could let an attacker read data from the proxy’s database and modify it, leading to unauthorized access to the proxy and the credential it manages.The maintainers said if it’s not possible to im

Page 1 of 3

Top posts driving the trend