CVE-2026-42208: Why AI Gateways Are Becoming a New Attack Surface

CVE-2026-42208: Why AI Gateways Are Becoming a New Attack Surface

The vulnerability CVE-2026-42208 in LiteLLM Proxy exposed an issue that goes far beyond a conventional SQL injection. AI Gateways have become central points through which API keys, request routing, and authentication for multiple LLM providers are managed. The root cause was architectural. As the NefariousPlan investigation showed, the developers assumed that the hashed_token variable always contained a hash of the API key. However, in the /key/block and /key/unblock handlers, for keys without the sk- prefix, it received the unhashed value from the Authorization: Bearer header. The code then continued to treat it as a secure hash and used it to build an SQL query, resulting in an SQL injection vulnerability.

The vulnerability affects LiteLLM Proxy versions 1.81.16–1.83.6 and allows an unauthenticated attacker to perform SQL injection through a specially crafted Authorization: Bearer header, potentially gaining access to the database and AI Gateway credentials. The issue is fixed in version 1.83.7 (updating to the latest stable version is recommended).

As noted in the CriminalIP research, LiteLLM centrally stores cloud LLM provider keys, model routing configurations, and AI Gateway parameters. Therefore, successful exploitation effectively means the compromise of the entire AI infrastructure, not just the web application. Within 36 hours of the advisory's publication, the first exploitation attempts appeared, and CISA added CVE-2026-42208 to the Known Exploited Vulnerabilities (KEV) catalog.

However, the issue extends beyond a single CVE. Another Criminal IP study showed that thousands of AI Gateways and AI Relays are already exposed to the Internet and available for reconnaissance. As of July 2026, a search by HTML title using the CriminalIP service (queries such as title: AI Gateway, title: Claude API, title: Claude Relay) identified more than 16,000 publicly accessible services. Many disclose information about the models (OpenAI, Claude, Gemini, DeepSeek), technologies in use (Nginx, Gunicorn), open ports, certificates, and management interfaces — information that makes it easier to identify known CVEs, misconfigurations, and weak authentication mechanisms.

Article 1 (NefariousPlan's analysis of CVE-2026-42208): https://nefariousplan.com/posts/litellm-cve-2026-42208-hashed-token-was-a-parameter-name

Article 2 (CriminalIP's brief analysis of CVE-2026-42208): https://www.criminalip.io/knowledge-hub/blog/34580

Article 3 (identifying AI Gateways in CriminalIP): https://www.criminalip.io/knowledge-hub/blog/35989