LiteLLM Discloses Critical SQL Injection Flaw as Active Attacks Emerge

LiteLLM is an open-source gateway that enterprises use to integrate services from multiple large language model providers, often centralizing API keys, account permissions and usage logs. The critical SQL injection vulnerability, tracked as CVE-2026-42208, can bypass authentication and allow unauthorized attackers to read or alter databases and obtain sensitive credentials. The impact could therefore extend to connected AI services and corporate data.

Security researchers detected hackers attempting active exploitation with malicious SQL commands just 36 hours after the LiteLLM development team disclosed the flaw, prompting a warning from the U.S. government. The team has released LiteLLM 1.83.7 to fix the input-validation issue. Organizations running older versions should upgrade immediately, rotate potentially exposed API keys and database credentials, and review query logs from before and after the disclosure for anomalous activity.