CVE-2026-42208Vulnerability
BerriAI LiteLLM SQL Injection Vulnerability
Exploited in the wildCISA added it to its Known Exploited Vulnerabilities list on .
Reported by 2 independent sources · first reported by SOCRadar · last reported
Last reported yesterday
CISA KEVAdded 8 May 2026
Fix due 11 May 2026
Used by ransomware: not knownCISA KEV catalogue
Fix due 11 May 2026
Used by ransomware: not knownCISA KEV catalogue
EPSS5.8%
higher than 93% of CVEsFIRST EPSS, as of 23 Oct 2026
higher than 93% of CVEsFIRST EPSS, as of 23 Oct 2026
What the reports say
2 reports, newest first · the exact sentence from each-
Exposed Infrastructure Reveals How Ransomware Affiliates Used AI Agents to Execute Intrusions“CVE-2026-42208 (LiteLLM SQL injection) (Developed or referenced)”
-
INC and The Gentlemen Ransomware: Exposed AI Infrastructure“CVE-2026-42208 / CVE-2026-9082LiteLLM SQLi / Drupal SQLiDeveloped or referenced; use not established”
Indicators reported together
named in the same reports- 45.227.254[.]43in 2 reports
- trulitesupport[.]comin 1 report
- 45.227.254[.]45in 1 report
- api.iquickline[.]comin 1 report
Copy these 4 indicators · defanged
Also named with it: CVE-2026-35616, CVE-2024-57727, CVE-2026-41940, CVE-2025-49113, CVE-2026-15409, CVE-2026-63030, CVE-2020-1472, CVE-2021-42278, CVE-2021-1675, CVE-2026-9082, CVE-2024-49112, CVE-2025-66568
Thanks — we review every report.