Actively exploited in the wild
BerriAI LiteLLM SQL Injection Vulnerability
BerriAI - LiteLLM · Listed in the CISA KEV since 2026-05-08. This indicates confirmed attacks in production environments.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2026-42208
CriticalCVSS 9.8KEVExploitation Probability (EPSS)
Very high risk100th percentile - higher than 100% of all known CVEs
Summary
In LiteLLM versions from 1.81.16 to before 1.83.7, a database query used during proxy API key checks is vulnerable to SQL injection due to mixing caller-supplied key value into the query text. An unauthenticated attacker can send a crafted Authorization header to any LLM API route, leading to reading and potentially modifying data in the proxy's database.
Risk Assessment
An attacker could gain unauthorized access to the proxy and the credentials it manages, potentially leading to data leakage and system compromise.
Recommendation
Upgrade LiteLLM to version 1.83.7 or later, which contains a fix for the SQL injection vulnerability.
Original NVD description (English source)
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.81.16 to before version 1.83.7, a database query used during proxy API key checks mixed the caller-supplied key value into the query text instead of passing it as a separate parameter. An unauthenticated attacker could send a specially crafted Authorization header to any LLM API route (for example POST /chat/completions) and reach this query through the proxy's error-handling path. An attacker could read data from the proxy's database and may be able to modify it, leading to unauthorised access to the proxy and the credentials it manages. This issue has been patched in version 1.83.7.