Critical LiteLLM SQL Injection Vulnerability Exploited in the Wild

A critical pre-authentication SQL injection (CVE-2026-42208) in the LiteLLM gateway enables unauthenticated attackers to execute arbitrary SQL against backend databases; researchers observed active, targeted exploitation within 36 hours of public disclosure aiming to steal API/master keys, provider credentials, and configuration data. Administrators are urged to upgrade to LiteLLM v1.83.7, rotate credentials, audit logs, and restrict external access due to likely compromise of internet-exposed instances.