PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

CVE-2026-42208: Pre-Authentication SQL Injection in LiteLLM Proxy

bishopfox.com | vulnerability | Critical | Actively exploited | CVE-2026-42208 | #active-exploitation | #ai-security | #vulnerability-research | #sql-injection | #pre-auth | #litellm | #cve-2026-42208 | #ai-gateway
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

CVE-2026-42208 is a pre-auth SQL injection in LiteLLM proxy 1.81.16–1.83.6: a missing bind lets attackers run SQL on any LLM route, confirmed via pg_sleep timing; exploitation hit ~36 hours later.
CVE
CVE-2026-42208
CVSS
9.8
Published
Collected

Related coverage

vulnerability · horizon3.ai
[CVE-2021-41765] Multiple Vulnerabilities in ResourceSpace
Advisory for CVE-2021-41765, a critical SQL injection vulnerability leading to remote code execution, by the Horizon3 red team.
vulnerability · horizon3.ai
CVE-2020-35700: Exploiting a Second-Order SQL Injection in LibreNMS < 21.1.0
# CVE-2020-35700: Exploiting a Second-Order SQL Injection in LibreNMS * * * ##### How can NodeZero help you? Let our experts walk you through a demonstration of NodeZero®, so you can see how to...
vulnerability · horizon3.ai
CVE-2020-29437: Authenticated SQL Injection in OrangeHRM < 4.6.0.1
OrangeHRM is software for Human Resource Management (HRM). In a routine audit of the open source version of OrangeHRM, we discovered a SQL injection…
research · slcyber.io
More Critical Bugs in Adobe Experience Manager: Pre-Auth RCE
Chaining an unauthenticated bulk import, an in-band XXE, leaked IMS credentials and Groovy execution into full pre-auth RCE on Adobe Experience Manager Cloud.
research · vercel.com
DeepsecBench: evaluating model performance in finding cybersecurity vulnerabilities
Today we're releasing DeepsecBench, a benchmark that evaluates how well different models find security vulnerabilities in application code.
High · vulnerability · bishopfox.com
A Crash, Not a Shell: SolarWinds Serv-U CVE-2026-28318
Bishop Fox confirms CVE-2026-28318: one unauthenticated POST with a deflate Content-Encoding crashes SolarWinds Serv-U via heap corruption, but three probed RCE paths dead-end; HF1 fixes it.
Back