CVE-2026-42208
BerriAI LiteLLM SQL Injection Vulnerability
Description
CVE-2026-42208 is a CRITICAL SQL injection vulnerability in BerriAI LiteLLM, an AI gateway proxy widely deployed to mediate calls to large-language-model providers in OpenAI-compatible format, with a CVSS 3.1 score of 9.8. The flaw lives in the database query used during proxy API key validation: from version 1.81.16 through 1.83.6, the caller-supplied API key is interpolated into the SQL string instead of being passed as a separate query parameter. An unauthenticated attacker can send a crafted Authorization header to any LLM API route such as POST /chat/completions, reach the vulnerable query through the proxy error-handling path, and read or modify data in the proxy database, including the credentials LiteLLM holds for downstream LLM providers. CISA added CVE-2026-42208 to the KEV catalog on May 8, 2026, with a remediation deadline of May 11, 2026. The EPSS score of 0.374 (97.2 percentile) indicates very high active exploitation pressure. The patch ships in LiteLLM 1.83.7.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| litellm | litellm | >= 1.81.16, < 1.83.7 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://github.com/BerriAI/litellm/releases/tag/v1.83.7-stable(Product, Release Notes)
- https://github.com/BerriAI/litellm/security/advisories/GHSA-r75f-5x8p-qvmc(Mitigation, Patch, Vendor Advisory)
- https://access.redhat.com/security/cve/CVE-2026-42208(Third Party Advisory)
- https://bugzilla.redhat.com/show_bug.cgi?id=2463965(Mitigation, Third Party Advisory)
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42208.json(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-42208(US Government Resource)
Weakness Type
CWE-89: Improper Neutralization of Special Elements used in an SQL Command (SQL Injection)
CWE-89 covers the classic failure mode where untrusted input is mixed into a SQL statement without separation between code and data. In CVE-2026-42208, the LiteLLM proxy reads the API key from the inbound Authorization header and concatenates it into the SQL string used to validate the key, rather than passing it as a bound parameter. An attacker who controls the header content controls part of the query syntax and can append additional SQL clauses, union queries to exfiltrate database rows, or update statements to modify stored credentials. Because the vulnerable code is in the authentication path, it is reachable on every LLM API endpoint the proxy exposes and triggers before any access control runs.
Learn more: CWE-89 — SQL Injection
Impact Analysis
CVE-2026-42208 carries a CVSS 3.1 score of 9.8 (CRITICAL) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H: network attack vector, low complexity, no privileges, no user interaction, and uniform High impact on Confidentiality, Integrity, and Availability. LiteLLM is widely deployed as a centralized AI gateway in enterprise environments because it abstracts away vendor-specific authentication and provides a single observability surface for OpenAI, Anthropic, Google, Azure, and other LLM providers. The proxy database typically holds the master API keys for every downstream provider the organization uses, plus the customer-facing virtual API keys it issues to internal teams and applications, budget and quota tables, and request logs that may contain prompt content with sensitive data. A successful exploit grants the attacker read access to all provider API keys (yielding pivot capability into every connected LLM account), the ability to issue or modify virtual keys, and write access to billing and quota controls. Where LiteLLM logs full requests and responses, the breach also exposes the historical prompt corpus, which routinely contains PII, source code, and internal documents.
Exploit Maturity
Public Exploits: The vulnerability is publicly documented in the GitHub Security Advisory GHSA-r75f-5x8p-qvmc, which describes the unauthenticated reachability through the error-handling path. The advisory level of technical detail makes development of a working exploit straightforward. Active Exploitation: CISA added CVE-2026-42208 to the KEV catalog on May 8, 2026, with a remediation deadline of May 11, 2026: a three-day window that reflects observed exploitation against production LiteLLM deployments. Exploitation Probability: The EPSS score of 0.374 (97.2 percentile) places the CVE in the top 3 percent of all CVEs by predicted exploitation likelihood. Practical Risk: LiteLLM is commonly exposed on the public internet or on broad internal networks to mediate AI calls from many tenants. Any LiteLLM instance running a version in the range 1.81.16 to 1.83.6 reachable to attackers should be considered compromise-likely, with downstream LLM provider keys exposed.
Remediation
- Upgrade LiteLLM to 1.83.7 or later immediately. The fix is shipped in LiteLLM v1.83.7-stable. Confirm the running version on every proxy host with
litellm --versionand verify in the LiteLLM admin UI. Where containerized, pin the new image tag and redeploy. - Rotate every credential the proxy holds. Treat all downstream LLM provider keys stored in LiteLLM as compromised: regenerate OpenAI, Anthropic, Google, Azure OpenAI, AWS Bedrock, and any other provider keys configured in the proxy. Revoke and reissue all virtual API keys LiteLLM has handed out to internal teams and applications, and rotate the database password used by LiteLLM.
- Audit for compromise. Inspect the LiteLLM database for unexpected rows in the key, budget, and user tables, especially entries created since version 1.81.16 was deployed. Review request logs for unusual Authorization headers containing SQL syntax (single quotes, UNION, SELECT, comment sequences). Check downstream provider dashboards for unexpected API usage, key creations, or billing changes.
- Constrain network exposure. Restrict the LiteLLM admin and API ports to known client networks via firewall or service mesh policy. Where the proxy must serve external clients, place it behind an authenticating reverse proxy and a Web Application Firewall with SQL-injection rulesets enabled.
- Long-term hardening. Apply CWE-89 mitigation principles: every database driver in the codebase must use parameterized queries or an equivalent prepared-statement API. Add automated SAST coverage that fails the build on string-concatenated SQL, and require security review for any code path that handles authentication or session state. Subscribe to the LiteLLM GitHub Security Advisories feed for fast notification of future issues in this critical AI infrastructure component.
Technical Details
CVE-2026-42208 is a CWE-89 SQL injection flaw in the API-key validation query of BerriAI LiteLLM versions 1.81.16 through 1.83.6. The vulnerable code path runs on every inbound request to any LLM proxy endpoint such as /chat/completions, /embeddings, or /completions because key validation precedes routing. When a request arrives, the proxy extracts the bearer token from the Authorization header and constructs a SQL statement to look up the key in its backing database, but the value is concatenated into the query text rather than passed as a separate bound parameter. The reachable trigger is the error-handling path: a malformed or non-matching key drives the proxy through a code branch that executes the unparameterized query, so an unauthenticated attacker can probe without any valid credential. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H confirms unauthenticated reachability over the network with full High impact on Confidentiality, Integrity, and Availability. The underlying database can be PostgreSQL or any other backend LiteLLM is configured against, so exploitation primitives vary, but the core capability (read and modify the entire LiteLLM database) is consistent. The patch in 1.83.7 replaces the string concatenation with a parameterized query that binds the caller-supplied key value as data, restoring the boundary between SQL code and user input.
Frequently Asked Questions
Is CVE-2026-42208 being actively exploited?
Yes. CISA added CVE-2026-42208 to the KEV catalog on May 8, 2026, with a three-day remediation deadline of May 11, 2026, which signals observed exploitation against deployed LiteLLM instances. The EPSS score of 0.374 (97.2 percentile) reflects very high continued exploitation pressure.
What versions of LiteLLM are affected?
All LiteLLM releases from 1.81.16 up to but not including 1.83.7 are vulnerable. The fix is shipped in LiteLLM 1.83.7-stable. Earlier versions before 1.81.16 are not affected by this specific code path.
How do I fix CVE-2026-42208?
Upgrade to LiteLLM 1.83.7 or later, then rotate every downstream LLM provider key configured in the proxy (OpenAI, Anthropic, Google, Azure, AWS Bedrock and others), reissue all virtual API keys handed to internal teams, rotate the LiteLLM database password, and audit request logs and downstream provider usage for indicators of compromise. Restrict the proxy to known client networks as a defense-in-depth measure.
Why is CVE-2026-42208 especially serious for AI deployments?
LiteLLM is the centralized credential vault for LLM access in many enterprise AI architectures: it holds the master keys for every connected provider and brokers requests for many teams. A successful exploit yields not only access to the LiteLLM database but indirect control over every downstream LLM account whose key was stored in the proxy. The exposure radius is the entire AI footprint of the organization, not just the proxy server.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.