Log in Start free

Actively exploited · Published May 8, 2026 · Assigned by GitHub_M

CVE-2026-42208LiteLLM: SQL injection in Proxy API key verification

Critical 9.8 Exploited

In plain English

A critical-severity SQL injection in litellm from BerriAI. Attackers are actively exploiting it in the wild (listed by CISA on May 8, 2026). The chance it is exploited in the next 30 days is estimated at 89.4% (higher than 99.8% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei, public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)89.4%top 0.2% of all CVEs
Exploited in the wildYesCISA KEV since May 8, 2026
Attack tooling3Metasploit, Nuclei, Public PoC

CISA guidance

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Federal agencies must remediate by May 11, 2026.

Official description

LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.81.16 to before version 1.83.7, a database query used during proxy API key checks mixed the caller-supplied key value into the query text instead of passing it as a separate parameter. An unauthenticated attacker could send a specially crafted Authorization header to any LLM API route (for example POST /chat/completions) and reach this query through the proxy's error-handling path. An attacker could read data from the proxy's database and may be able to modify it, leading to unauthorised access to the proxy and the credentials it manages. This issue has been patched in version 1.83.7.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
PyPIlitellm1.83.7GHSA-r75f-5x8p-qvmc
PyPIlitellm1.83.7PYSEC-2026-391

Affected products (as reported)

VendorProductVersions
BerriAI litellm >= 1.81.16, < 1.83.7

Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References