CVE-2026-42208: LiteLLM proxy SQL injection in API key check

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityUnauthenticated, network-reachable SQL injection with high confidentiality and integrity impact, a CVSS 4.0 score of 9.3, KEV listing and a very high EPSS probability.

What it is

LiteLLM versions 1.81.16 to before 1.83.7 build a database query for proxy API key checks by concatenating the caller-supplied key into the query text rather than binding it as a parameter. An unauthenticated attacker can reach that query through the proxy's error-handling path by sending a crafted Authorization header to any LLM API route, such as POST /chat/completions. Because the proxy stores and manages upstream LLM credentials, a successful injection puts both the database and those credentials at risk.

Impact

An attacker can read data from the proxy's database and may be able to modify it, gaining unauthorised access to the proxy and the credentials it manages. This can expose upstream LLM API keys and other secrets held by the gateway.

Attack surface

Reachable over the network with no authentication and no user interaction: a crafted Authorization header sent to any LLM API route (for example POST /chat/completions) reaches the vulnerable query via the proxy's error-handling path. The CVSS 4.0 vector confirms AV:N, AC:L, PR:N and UI:N.

Exploitation

CVE-2026-42208 was added to CISA KEV on 2026-05-08 with a 2026-05-11 remediation due date, indicating known exploitation; EPSS gives a 30-day probability of 0.8942 (99.776th percentile). No ransomware campaign use is documented.

What to do

• Upgrade LiteLLM to version 1.83.7 or later, which contains the patch.
• If immediate upgrade is not possible, restrict network access to the LiteLLM proxy so only trusted clients can reach LLM API routes.
• Rotate all upstream LLM API keys and other credentials managed by the proxy, since database read and possible write access could have exposed them.
• Review proxy database contents and access logs for signs of tampering or unexpected reads.
• Follow CISA KEV required action and applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Detection

• Search proxy and web logs for Authorization headers containing SQL metacharacters (quotes, comment sequences, UNION, stacked statements) sent to LLM API routes such as /chat/completions.
• Monitor for requests that trigger the proxy's error-handling path on API key checks, especially repeated or malformed Authorization values from a single source.
• Alert on database queries or errors originating from the proxy that contain caller-supplied key text rather than bound parameters.
• Audit proxy database and credential store for unexpected reads, modifications, or new entries that do not match normal key provisioning.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.