# LiteLLM CVE-2026-42208: AI Gateway Pre-Authentication Credential Extraction - **Artifact ID:** CHQ-EX-2026-016 - **Public record:** https://record.cybersecurityhq.com/exhibits/chq-ex-2026-016 - **Machine-record SHA-256:** `3101cf82a31708642fba98369636f530379d3206886e7157b26650d6e8969557` ## Complete structured record ```json { "id": "CHQ-EX-2026-016", "title": "LiteLLM CVE-2026-42208: AI Gateway Pre-Authentication Credential Extraction", "subtitle": "Pre-authentication SQL injection in the LiteLLM AI LLM gateway proxy enabled unauthenticated extraction of aggregated AI provider credentials within thirty-six hours of advisory publication, with attacker enumeration demonstrating schema-level knowledge of internal credential tables before any public proof-of-concept existed.", "classification_notice": [ "This document is published as a CHQ Exhibit. It records historical conditions, breach events, and industry practices as they existed during the periods described. This Exhibit records observed conditions, exploitation mechanics, and structural patterns as documented in public disclosures, security research publications, and vendor advisories during the stated period.", "This document does not address present conditions and carries no current applicability. No evaluation of past practices is intended or implied.", "CHQ Exhibits are not superseded by later artifacts unless explicitly invalidated for factual error." ], "metadata": { "artifact_class": "EXHIBIT", "temporal_scope": "OPERATIONAL (APRIL 24–26, 2026)", "authority_level": "NON-JUDGMENTAL", "reliance_status": "EXHIBIT_ONLY", "update_policy": "ERRATA_ONLY", "temporal_start": "2026-04-24", "temporal_end": "2026-04-26" }, "sections": [ { "heading": "I. Factual Record", "content": [ "Vulnerability: CVE-2026-42208, CVSS 9.3. Pre-authentication SQL injection in the LiteLLM AI LLM gateway proxy. The API key verification code path concatenated the caller-supplied Authorization: Bearer header value directly into a SQL query without parameterization. An unauthenticated attacker sending a crafted Bearer header to any LLM API route reached the vulnerable query through an error-handling path.", "Affected Software: LiteLLM versions prior to 1.83.7. LiteLLM is a multi-provider AI gateway with approximately 22,000 GitHub stars and broad enterprise adoption. The proxy centralizes API credentials for over one hundred LLM providers including OpenAI, Anthropic, AWS Bedrock, and Google Vertex AI, exposing a unified OpenAI-compatible API surface.", "Disclosure Timeline: LiteLLM published a security advisory on April 20, 2026. The vulnerability received a CVE assignment and global indexing in the GitHub Advisory Database on April 24, 2026 at 16:17 UTC. CISA KEV catalog inclusion did not occur at disclosure.", "Exploitation Onset: Sysdig Threat Research telemetry recorded the first exploitation attempt on April 26, 2026 at approximately 04:24 UTC, thirty-six hours and seven minutes after global advisory indexing. Two source IP addresses operating from adjacent /22 blocks, twenty-one minutes apart, both using a Python 3.12 / aiohttp 3.9.1 user agent. Pattern consistent with a single operator rotating egress.", "Attacker Behavior: The exploitation attempts demonstrated schema-level precision before any public proof-of-concept existed. Queries enumerated three specific Prisma table names with correct casing — LiteLLM_VerificationToken, litellm_credentials, and litellm_config — and performed a deliberate column-count discovery sweep against each. The schema is open source. Reconstruction from the public LiteLLM repository was sufficient to construct the exploitation queries.", "Targeted Data: The three enumerated tables hold the platform’s primary credential stores. LiteLLM_VerificationToken contains virtual API keys issued to consumers of the LiteLLM gateway. litellm_credentials holds the upstream provider credentials the gateway uses to call external LLM services. litellm_config contains gateway configuration including secret material. Successful extraction would yield credentials for every connected AI provider plus all virtual and master keys.", "Outcome: No successful authenticated follow-on activity was confirmed in the available telemetry. Sysdig characterized the observed behavior as the speed and precision of enumeration rather than confirmed compromise. The blast radius if successful would extend to all connected AI provider accounts.", "Belgium CCB issued an advisory. Multiple secondary outlets covered the disclosure. The vulnerability did not appear in the CISA KEV catalog at the time of first observed exploitation, creating an alerting gap for organizations relying on KEV-keyed monitoring." ] }, { "heading": "II. Failure Pattern", "content": [ "The vulnerability illustrates a structural property of AI gateway deployments rather than an unusual implementation flaw. A SQL injection in an authentication path is a long-recognized vulnerability class. The exhibit-class significance is the deployment context in which it occurred.", "LiteLLM is deployed as a credential aggregation point. Application teams stand up the gateway to provide a single OpenAI-compatible API surface across multiple upstream providers. The gateway holds long-lived credentials for each provider it routes to. A single compromise of the gateway is functionally equivalent to compromise of every connected provider account.", "This deployment topology was not classified as privileged infrastructure by most organizations operating it. The gateway was treated as developer tooling, deployed by application teams, often outside the review cadence applied to secrets managers, identity providers, and other systems with comparable credential aggregation properties. The credential blast radius did not match the governance treatment.", "The thirty-six hour exploitation window is the second structural element. Most enterprise patch programs operate on cycles of days to weeks for non-critical systems. The attacker community demonstrated that AI gateways are now subject to dedicated research investment with exploitation capability staged in advance of disclosure. The schema-precision enumeration without a public PoC indicates the attacker knew the internal data model before the exploitation began.", "The CVE-keyed alerting gap is the third element. LiteLLM’s vulnerability was published as a GitHub Security Advisory and assigned a CVE, but it was not surfaced in the CISA KEV catalog at the time of first observed exploitation. Organizations relying on KEV-keyed alerting for prioritization received no signal during the exploitation window." ] }, { "heading": "III. Referenced By", "content": [ "CHQ-P-2026-009 — Position: Identity Systems Are Becoming the Execution Control Plane of Enterprise Security.", "CHQ-P-2026-014 — Position: Management Plane Compromise Produces Deterministic Control That Operates Outside Identity Enforcement.", "CHQ-P-2026-015 — Position: Execution Pipelines Function as Control Planes Without Verification Primitives Capable of Validating the Authority They Execute.", "CHQ-SC-2026-002 — Condition: Management Plane Concentration.", "CHQ-SC-2026-006 — Condition: Exploitation Timing Precedes Defender Awareness.", "CHQ-ED-2026-017 — Evidence Docket: CHQ-P-2026-014 (Management Plane Compromise).", "CHQ-ED-2026-018 — Evidence Docket: CHQ-P-2026-015 (Execution Pipelines as Control Planes, successor docket)." ] } ], "closing_statement": "This Exhibit records historical conditions. It carries no present applicability. No judgment is made about any organization, vendor, security posture, or attribution conclusion.\n\nTemporal scope: April 24–26, 2026. Exhibit issuance date is May 4, 2026. This Exhibit records findings as reported by named security research organizations, not as established fact.\n\nSources: Sysdig Threat Research, BleepingComputer, SecurityWeek, Centre for Cybersecurity Belgium, LiteLLM project security advisory, GitHub Advisory Database.", "hash_scope": "Full exhibit content body", "hash_generated": "2026-05-04" } ```