The injection sits inside the auth check. In versions 1.81.16 through 1.83.6, the Bearer value goes straight into a SELECT against `LiteLLM_VerificationToken` with no parameter binding, so a single quote closes the string literal and the remainder of the header is SQL [3]. Nothing stands in front of it, because the code runs before the proxy has decided who the caller is: there is no rate limiter or IP allow list, and no captcha either, and anything answering on port 4000 qualifies [4]. One UNION reaches all three of the tables that matter [c9b].
Anchor the clock to the two publications. LiteLLM's maintainers posted the repository advisory at 21:14 UTC on April 20 [6]. The global database entry landed at 16:17 UTC on April 24 [5], 91 hours and 3 minutes later [18]. Add Sysdig's 36 hours and 7 minutes [7] and the first attempt arrives at 04:24 UTC on April 26 [19], which is where Sysdig's phase-one enumeration window opens [17]. Total elapsed from the maintainer advisory: 127 hours and 10 minutes [20]. The enumeration itself ran 21 minutes [21].
What Sysdig captured reads as prepared work rather than a scanner. The first source address, 65.111.27.132, opened with the canonical proof-of-concept shape [17], and the operator already had LiteLLM's Prisma-generated PostgreSQL identifier casing correct before running a column-count sweep against each table [10]. Sysdig attributes both phases to one operator across two adjacent egress IPs, with a short unauthenticated probe of the key-management endpoints afterwards [16]. The traffic and the two addresses are public record; who owns them, and whether a single row left the database, remains unknown [11].
Sysdig's remediation line is stricter than its own findings. Patch to 1.83.7, which replaces the interpolation with a parameterized query, and treat any internet-facing instance exposed during the window as compromised [14]. That instruction follows from LiteLLM's key handling rather than from anything in the capture. A virtual key or master key that leaves the database can be replayed against `/chat/completions` from any address, since keys are not bound to a source by default [13]. A patch closes the injection path, though any key copied before that point remains valid regardless.
String interpolation in the auth path of an infrastructure proxy is a recurring shape, and Sysdig points to a similar flaw reported recently in ingress-nginx [15]. What differs behind LiteLLM is the database itself: the gateway exists to centralize paid provider credentials for OpenAI, Anthropic and the rest [1]. That is what made an advisory less than two days old worth custom tooling instead of an SQLmap spray [8].
