Tag
#litellm
Malicious LiteLLM 1.107.0 Steals Credentials and Backdoors Hosts
A threat actor hijacked LiteLLM's release pipeline with a leaked, never-revoked master key and pushed a malicious 1.107.0 to PyPI and Docker on October 21, 2026. The wheel installs Python startup files that steal credentials and open an hourly backdoor even when LiteLLM is never imported. PyPI quarantined the version after 1 hour 44 minutes; anyone who installed it must rebuild the environment and rotate every reachable secret.
Oct 25, 2026
Exploit CVE-2026-42208: LiteLLM Unauthenticated SQL Injection via Bearer Token
A technical breakdown of CVE-2026-42208, a CVSS 9.3 critical unauthenticated SQL Injection vulner...
May 22, 2026