Hackers are exploiting a critical LiteLLM pre-auth SQLi flaw

In yet another instance of threat actors quickly jumping on the exploitation bandwagon, a newly disclosed critical security flaw in BerriAI's LiteLLM Python package has come under

A default low-privilege account on a LiteLLM proxy can climb to full admin and run code on the server by chaining three vulnerabilities, researchers at Obsidian Security disclosed

A high-severity security flaw in LMDeploy, an open-source toolkit for compressing, deploying, and serving LLMs, has come under active exploitation in the wild less than 13 hours

<h2> 1. Basic Information </h2> <ul> <li> <strong>Article Name:</strong> CVE-2026-105740 Exploitation Observed — langflow</li> <li> <strong>Source:</strong> Previdian</li> <li>

<!-- SC_OFF --><div class="md"><p>If you’re doing AI/LLM development in Python, you’ve almost certainly used <code>litellm</code>—it’s the package that unifies calls to OpenAI,

Nearly one in ten of the internet-facing LiteLLM servers that&nbsp;Wiz Research&nbsp;scanned in February accepted&nbsp;sk-1234, the example admin key in LiteLLM's own setup guide.