CVE-2026-42208 BerriAI LiteLLM SQL Injection
Unauthenticated attackers can exploit SQL injection in LiteLLM proxy API key verification to read and modify database contents, potentially compromising managed credentials.
- Exploited in the wild
- Since 8 May 2026
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-42208?
CVE-2026-42208 is a critical SQL injection vulnerability in BerriAI litellm, published on 8 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.81.16 to before version 1.83.7, a database query used during proxy API key checks mixed the caller-supplied key value into the query text instead of passing it as a separate parameter. An unauthenticated attacker could send a specially crafted Authorization header to any LLM API route (for example POST /chat/completions) and reach this query through the proxy's error-handling path. An attacker could read data from the proxy's database and may be able to modify it, leading to unauthorised access to the proxy and the credentials it manages. This issue has been patched in version 1.83.7.
Weakness: CWE-89
Which versions are affected by CVE-2026-42208?
3 open source packages ship an affected version, including litellm. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
litellm PyPI | From 1.81.16 | 1.83.7 |
litellm PyPI | From 1.81.16 | 1.83.7 |
litellm PyPI | From 1.81.16 | 1.83.7 |
Products include Litellm Litellm.
How do I fix CVE-2026-42208?
Upgrade litellm to 1.83.7 or later. US federal agencies must fix it by 11 May 2026.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2026-42208 being exploited?
Yes. Attackers have exploited CVE-2026-42208 in the wild since at least 8 May 2026.
Public exploit code: 1 Metasploit module, 1 Nuclei template and 6 proofs of concept on GitHub.
Other vulnerabilities in BerriAI litellm
Sources
Also known as GHSA-r75f-5x8p-qvmc, MINI-5vrj-xm9r-fw8v, MINI-8mpq-7g6h-p423, MINI-c97q-f268-2m9f, MINI-jpp6-g7fg-cp46, PYSEC-2026-391.