Case litellm-sqli-cve-2026-42208AI supply chainOct 14, 2026Worldwide

LiteLLM proxy SQL injection (CVE-2026-42208) actively exploited

CISA says a LiteLLM SQL injection is actively exploited, letting attackers read and possibly modify the proxy database and reach the credentials it manages.

HighAttack on AIStatus: OngoingVerified case file

Open in the interactive map Cite this case

Reported: Oct 14, 2026
Location: Worldwide
Target: BerriAI LiteLLM proxy deployments
Severity: High
Triggered by: Unknown
Actor type: Unknown
Reported loss: None reported
CVE: CVE-2026-42208

What happened

CISA says a LiteLLM SQL injection is actively exploited, letting attackers read and possibly modify the proxy database and reach the credentials it manages.

Impact: Database read and possible modification, with unauthorized access to the proxy and managed credentials.

Who triggered it

Actor: Unknown

Attribution: Not stated in the CISA KEV entry.

Motive: Unknown

How it happened

Attack vector: SQL injection against the LiteLLM proxy.

Root cause: SQL injection vulnerability in LiteLLM.

Timeline

Oct 14, 2026Reported by CISA KEV

Response

Added to CISA's Known Exploited Vulnerabilities catalog.

Current status: Ongoing

Sources (open in a new tab)

CISA KEV cisa.gov

Cite this case

LiteLLM proxy SQL injection (CVE-2026-42208) actively exploited. AI Threat Watch, case litellm-sqli-cve-2026-42208, Oct 14, 2026. https://aithreat.io/cases/litellm-sqli-cve-2026-42208/

Permanent link: https://aithreat.io/cases/litellm-sqli-cve-2026-42208/