Active Exploitation
CVE-2026-42208: Why AI Gateways Are Becoming a New Attack Surface
PT ID: PT-2026-35643
https://dbugs.ptsecurity.com/vulnerability/PT-2026-35643
The vulnerability CVE-2026-42208 -> (https://dbugs.ptsecurity.com/vulnerability/CVE-2026-42208) in LiteLLM Proxy exposed an issue that goes far beyond a conventional SQL injection. AI Gateways have become central points through which API keys, request routing, and authentication for multiple LLM providers are managed.
The root cause was architectural. As the NefariousPlan investigation showed, the developers assumed that the "hashed_token" variable always contained a hash of the API key. However, in the "/key/block" and "/key/unblock" handlers, for keys without the "sk-" prefix, it received the unhashed value from the "Authorization: Bearer" header. The code then continued to treat it as a secure hash and used it to build an SQL query, resulting in an SQL injection vulnerability.
The vulnerability affects LiteLLM Proxy versions 1.81.16–1.83.6 and allows an unauthenticated attacker to perform SQL injection through a specially crafted "Authorization: Bearer" header, potentially gaining access to the database and AI Gateway credentials. The issue is fixed in version 1.83.7 (updating to the latest stable version is recommended).
As noted in the CriminalIP research, LiteLLM centrally stores cloud LLM provider keys, model routing configurations, and AI Gateway parameters. Therefore, successful exploitation effectively means the compromise of the entire AI infrastructure, not just the web application. Within 36 hours of the advisory's publication, the first exploitation attempts appeared, and CISA added CVE-2026-42208 -> (https://dbugs.ptsecurity.com/vulnerability/CVE-2026-42208) to the Known Exploited Vulnerabilities (KEV) catalog.
However, the issue extends beyond a single CVE. Another Criminal IP study showed that thousands of AI Gateways and AI Relays are already exposed to the Internet and available for reconnaissance. As of July 2026, a search by HTML title using the CriminalIP service (queries such as "title: AI Gateway", "title: Claude API", "title: Claude Relay") identified more than 16,000 publicly accessible services. Many disclose information about the models (OpenAI, Claude, Gemini, DeepSeek), technologies in use (Nginx, Gunicorn), open ports, certificates, and management interfaces — information that makes it easier to identify known CVEs, misconfigurations, and weak authentication mechanisms.
Article 1 (NefariousPlan's analysis of CVE-2026-42208): https://nefariousplan.com/posts/litellm-cve-2026-42208-hashed-token-was-a-parameter-name
Article 2 (CriminalIP's brief analysis of CVE-2026-42208): https://www.criminalip.io/knowledge-hub/blog/34580
Article 3 (identifying AI Gateways in CriminalIP): https://www.criminalip.io/knowledge-hub/blog/35989
#dbugs_attacks
Post summary
LiteLLM Proxy’s CVE‑2026‑42208 allows unauthenticated SQL injection through a crafted Authorization header, exposing AI gateway credentials; exploitation attempts were observed within 36 hours of disclosure and the defect has been added to CISA’s KEV list, with a patch available in v1.83.7.
