CVE-2026-42208
LiteLLM: SQL injection in Proxy API key verification
Description
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.81.16 to before version 1.83.7, a database query used during proxy API key checks mixed the caller-supplied key value into the query text instead of passing it as a separate parameter. An unauthenticated attacker could send a specially crafted Authorization header to any LLM API route (for example POST /chat/completions) and reach this query through the proxy's error-handling path. An attacker could read data from the proxy's database and may be able to modify it, leading to unauthorised access to the proxy and the credentials it manages. This issue has been patched in version 1.83.7.
In plain language
AI Act nowIf you use LiteLLM versions 1.81.16 through 1.83.6, an Internet attacker can send a fake API key and (via a SQL injection bug) potentially take control of LiteLLM’s proxy database—this is a serious, urgent risk, even without any login.
In LiteLLM, a SQL injection (CWE-89) in the Proxy API key verification path allows an unauthenticated attacker to execute arbitrary SQL queries by crafting a malicious Authorization header, leading to potential database read/modify of the proxy and managed credentials; the issue is added to CISA KEV (due 2026-05-11).
What to do now
- Check which LiteLLM version you are running (for example, by reviewing your LiteLLM deployment image/package version or startup logs) and confirm whether it is in the range 1.81.16 to 1.83.6.
- If you are using that version range and the Proxy API is exposed to the Internet, treat your setup as vulnerable.
- Upgrade LiteLLM to version 1.83.7 or later.
- After upgrading, verify the Proxy API is only reachable from trusted networks (or protected behind appropriate network controls) and re-check that the deployed version is the fixed one.
CVSS Vector Breakdown
AV:NAttack VectorAC:LAttack ComplexityPR:NPrivileges RequiredUI:NUser InteractionS:UScopeC:HConfidentialityI:HIntegrityA:HAvailabilityWeaknesses
Affected Products
Exploitability
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Attack Graph
Click technique nodes for MITRE ATT&CK details · drag to pan · Ctrl/⌘ + scroll to zoom, or go fullscreen.
MITRE ATT&CK
1 techniqueReferences
- Weekly Metasploit Update: Modules for Audiobookshelf, LiteLLM, Next.js, Dalfox and moreen·Rapid7 Blog· Research Audiobookshelf web-app
- LiteLLM Vulnerability Chain Lets Low-Privilege Users Take Over AI Gateway Serversen·The Hacker News· PoC LiteLLM ai-ml
- LiteLLM Flaw CVE-2026-42271 Exploited in the Wild, Chains to Unauthenticated RCEen·The Hacker News· Exploited BerriAI LiteLLM ai-ml
- CVE-2026-42208: Pre-Authentication SQL Injection in LiteLLM Proxyen-us·Bishop Fox· Exploited LiteLLM Proxy rce
- 4th May – Threat Intelligence Reporten-us·Check Point Research· Roundup ShinyHunters data-breach
Unlock Complete Vulnerability Intelligence
Get the full picture for CVE-2026-42208 and every CVE in our database. Create a free account — no credit card required.
Create Free Account