LiteLLM Pre-Auth SQLi Actively Exploited: CVE-2026-42208

Hackers are actively exploiting a critical pre-authentication SQL injection vulnerability, CVE-2026-42208, in the LiteLLM open-source large language model (LLM) gateway. BleepingComputer reports that attackers are targeting sensitive information stored within these systems.

This flaw allows unauthenticated adversaries to execute arbitrary SQL queries, potentially leading to full data exfiltration from the underlying database. Given LiteLLM’s role as a gateway, this means direct access to proprietary models, user prompts, sensitive configurations, and potentially even user data processed by the LLMs.

The attacker’s calculus here is clear: LLM gateways are rich targets. They sit at the intersection of application logic and powerful AI models, often handling a trove of confidential data. A pre-auth SQLi on such a component is a direct path to intellectual property theft and deep system compromise.