Sysdig Observes Targeted LiteLLM SQL Injection Attempts 36 Hours After Disclosure

Summary

Sysdig TRT observed targeted pre-auth SQL injection attempts against LiteLLM 36 hours after disclosure of CVE-2026-42208, with UNION payloads probing credential tables. No authenticated follow-on or confirmed extraction was observed; Sysdig recommends patching and key-

Key points

CVE-2026-42208 is a pre-authentication SQL injection affecting LiteLLM versions 1.81.16 through 1.83.6; the Authorization bearer value was concatenated into a PostgreSQL query, allowing arbitrary SELECT statements.
Sysdig TRT observed the first exploitation attempt on April 26, 2026, 36 hours and seven minutes after the advisory was indexed in the GitHub Advisory Database.
The observed UNION payloads probed LiteLLM_VerificationToken, litellm_credentials, and litellm_config, which contain virtual keys, provider credentials, and environment configuration.
Requests came from two egress IPs with the same reported autonomous system and user-agent; Sysdig assessed the activity as consistent with one operator rotating egress IPs.
Sysdig observed no authenticated calls using extracted keys, virtual-key creation, or confirmed credential reuse; the article does not establish successful extraction or compromise.
The fix is LiteLLM v1.83.7 or later. Sysdig recommends rotating stored keys and credentials for vulnerable internet-reachable instances, restricting proxy access, and monitoring for the described request patterns.

Article Details

Attack Vectors: An operator attempted pre-authentication SQL injection against LiteLLM's proxy authentication path by placing UNION-based payloads in the Authorization: Bearer header.
The payloads targeted LiteLLM_VerificationToken, litellm_credentials, and litellm_config to enumerate virtual keys, provider credentials, and environment variables; column-count discovery was also attempted.
The operator repeated payloads from a second egress IP and then probed /key/generate and /key/info without authentication. Sysdig reported no confirmed authenticated follow-on or successful compromise.
Defensive Notes: Upgrade LiteLLM to v1.83.7 or later; the article identifies versions 1.81.16 through 1.83.6 as affected.
Rotate virtual API keys, master keys, and provider credentials for internet-reachable LiteLLM instances running vulnerable versions.
Restrict proxy access to an internal network or an authenticated reverse proxy. If patching is delayed, block suspicious Authorization header values containing quotes or SQL keywords.
Monitor web-server logs for Bearer values beginning with sk-litellm' and UNION SELECT payloads targeting the named LiteLLM tables.
Review upstream provider billing and traffic for requests from unfamiliar IPs following exposure.

Indicators of compromise

Type	Indicator	Context
IPV4	`65[.]111[.]25[.]67`	Second source IP observed replaying SQL injection payloads and probing LiteLLM key-management endpoints without authentication.
IPV4	`65[.]111[.]27[.]132`	Source IP observed issuing UNION-based SQL injection payloads and schema-enumeration probes against LiteLLM.