LiteLLM CVE-2026-42208 SQL Injection Exploited within 36 Hours of Disclosure

2026-04-30

Attackers abused CVE-2026-42208, a pre-auth SQL injection in LiteLLM's proxy API key check, less than 36 hours after public disclosure, to query credential and config tables holding OpenAI, Anthropic, and AWS Bedrock keys.