CVE-2026-42208: Targeted SQL injection against LiteLLM's authentication path discovered 36 hours following vulnerability disclosure

CVE-2026-42208 is a significant SQL injection vulnerability in LiteLLM, an open-source LLM gateway, allowing attackers to execute arbitrary SQL commands against its PostgreSQL backend without authentication. Discovered shortly after its disclosure, this vulnerability arises from the improper handling of the Authorization: Bearer header in SQL queries, which leads to a critical security flaw. The vulnerability was first indexed in the GitHub Advisory Database and witnessed its initial exploitation attempt within 36 hours, targeting high-value tables containing virtual API keys, provider credentials, and configuration data. The attack demonstrated precision in schema enumeration, suggesting the operator's prior knowledge of LiteLLM's database schema. Although no successful data exfiltration was confirmed, the incident underscores the risk posed by AI gateways that consolidate sensitive credentials, emphasizing the need for immediate patching and enhanced security measures. The new version 1.83.7 addresses the issue by replacing unsafe string interpolation with parameterized queries, and operators are urged to update and secure their LiteLLM deployments promptly.