{"answers":{"affected":"3 open source packages ship an affected version, including litellm. It affects 1 product.","exploited":"Yes. Attackers have exploited CVE-2026-42208 in the wild since at least 8 May 2026.","fix":"Upgrade litellm to 1.83.7 or later. US federal agencies must fix it by 11 May 2026.","what":"CVE-2026-42208 is a critical SQL injection vulnerability in BerriAI litellm, published on 8 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-42208 and fix it if it is affected.\n\nWhat it is: CVE-2026-42208 is a critical SQL injection vulnerability in BerriAI litellm, published on 8 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: Yes. Attackers have exploited CVE-2026-42208 in the wild since at least 8 May 2026.\n\nAffected packages and fixed versions:\n- litellm (PyPI): affected from 1.81.16; fixed in 1.83.7\n- litellm (PyPI): affected from 1.81.16; fixed in 1.83.7\n- litellm (PyPI): affected from 1.81.16; fixed in 1.83.7\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-42208/ (Markdown: https://insights.sbomify.com/CVE-2026-42208/index.md)","id":"CVE-2026-42208","markdown":"https://insights.sbomify.com/CVE-2026-42208/index.md","name":"CVE-2026-42208","record":{"aliases":["GHSA-r75f-5x8p-qvmc","MINI-5vrj-xm9r-fw8v","MINI-8mpq-7g6h-p423","MINI-c97q-f268-2m9f","MINI-jpp6-g7fg-cp46","PYSEC-2026-391"],"analysis":{"component_type":"server_software","fix_type":"upgrade","impacts":["data_read","data_modify"],"network_reachable":"yes","non_default_config":false,"product_category":"AI Gateway Proxy","requires_auth":"none","summary":"Unauthenticated attackers can exploit SQL injection in LiteLLM proxy API key verification to read and modify database contents, potentially compromising managed credentials.","user_interaction":"not_required","vuln_class":"sql_injection"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[{"product":"litellm","vendor":"litellm"}],"cvss":{"score":9.3,"severity":"critical","source":"cna","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0"},"cwes":[{"id":"CWE-89","name":"Improper Neutralization of Special Elements used in an SQL Command"}],"description":"LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.81.16 to before version 1.83.7, a database query used during proxy API key checks mixed the caller-supplied key value into the query text instead of passing it as a separate parameter. An unauthenticated attacker could send a specially crafted Authorization header to any LLM API route (for example POST /chat/completions) and reach this query through the proxy's error-handling path. An attacker could read data from the proxy's database and may be able to modify it, leading to unauthorised access to the proxy and the credentials it manages. This issue has been patched in version 1.83.7.","ecosystems":["PyPI"],"exploits":{"exploitdb":0,"first_seen":"2026-04-20","github_poc":6,"max_poc_stars":1,"metasploit":1,"nuclei":1,"refs":[{"date":"2026-05-22T23:22:04Z","kind":"github_poc","ref":"https://github.com/ridhinva/litellm-sqli-scanner","stars":1,"title":"Scanner: CVE-2026-42208 LiteLLM SQL Injection — Python scanner for BerriAI LiteLLM proxy instances"},{"date":"2026-04-20","kind":"metasploit","ref":"auxiliary/scanner/http/litellm_proxy_sqli","stars":null,"title":"BerriAI LiteLLM Proxy Pre-Auth SQL Injection Scanner"},{"date":"2026-04-28T16:57:53Z","kind":"github_poc","ref":"https://github.com/imjdl/CVE-2026-42208_lab","stars":0,"title":"CVE-2026-42208 lab"},{"date":"2026-05-03T10:55:34Z","kind":"github_poc","ref":"https://github.com/0xredash/CVE-2026-42208","stars":0,"title":"CVE-2026-40487"},{"date":"2026-05-10T02:07:25Z","kind":"github_poc","ref":"https://github.com/Zeltoc/threat-intel-brief-cve-2026-42208-litellm","stars":0,"title":"Threat intelligence brief on CVE-2026-42208, a critical pre-auth SQL injection in BerriAI LiteLLM exploited within 36 hours of disclosure. Covers attack path, detection opportunities, and recommended actions."},{"date":"2026-05-10T12:11:44Z","kind":"github_poc","ref":"https://github.com/rootdirective-sec/CVE-2026-42208-Lab","stars":0,"title":null},{"date":"2026-05-30T04:51:39Z","kind":"github_poc","ref":"https://github.com/HAERIN-L/poc_cve-2026-42208","stars":0,"title":null},{"date":null,"kind":"nuclei","ref":"http/cves/2026/CVE-2026-42208.yaml","stars":null,"title":"LiteLLM - SQL Injection"}],"tier":"exploited"},"has_fix":true,"headline":"BerriAI LiteLLM SQL Injection","id":"CVE-2026-42208","indexable":true,"kev":{"dateAdded":"2026-05-08","dueDate":"2026-05-11","knownRansomwareCampaignUse":"Unknown","product":"LiteLLM","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","vendorProject":"BerriAI","vulnerabilityName":"BerriAI LiteLLM SQL Injection Vulnerability"},"kind":"cve","links":{"ecosystem":"PyPI","product":null,"products":[],"type":"sql_injection","year":"2026"},"n_packages":3,"n_references":2,"next":{"headline":"FlashMQ: Division by zero crash when using non-default deferred retained message setting","id":"CVE-2026-42209"},"packages":[{"ecosystem":"PyPI","fixed":["1.83.7"],"introduced":["1.81.16"],"last_affected":[],"package":"litellm","purl":null,"source":"GHSA-r75f-5x8p-qvmc"},{"ecosystem":"PyPI","fixed":["1.83.7"],"introduced":["1.81.16"],"last_affected":[],"package":"litellm","purl":"pkg:pypi/litellm","source":"GHSA-r75f-5x8p-qvmc"},{"ecosystem":"PyPI","fixed":["1.83.7"],"introduced":["1.81.16"],"last_affected":[],"package":"litellm","purl":"pkg:pypi/litellm","source":"PYSEC-2026-391"}],"prev":{"headline":"Magento LTS: Open Redirect via Unvalidated `uenc` Parameter in `stockAction()` - magento-lts","id":"CVE-2026-42207"},"products":["litellm"],"published":"2026-05-08","related":[{"cvss_score":8.8,"headline":"BerriAI LiteLLM Improper Authentication","id":"CVE-2026-59822","kev_date_added":"2026-09-02","published":"2026-07-08"},{"cvss_score":8.7,"headline":"BerriAI LiteLLM Command Injection","id":"CVE-2026-42271","kev_date_added":"2026-06-08","published":"2026-05-08"},{"cvss_score":9.8,"headline":"Remote Code Execution in BerriAI/litellm","id":"CVE-2024-5751","kev_date_added":null,"published":"2024-06-27"},{"cvss_score":9.8,"headline":"Server-Side Template Injection in BerriAI/litellm","id":"CVE-2024-2952","kev_date_added":null,"published":"2024-04-10"},{"cvss_score":9.5,"headline":"LiteLLM: Authentication Bypass via Host Header Injection","id":"CVE-2026-49468","kev_date_added":null,"published":"2026-06-22"},{"cvss_score":9.4,"headline":"LiteLLM has an authentication bypass via OIDC userinfo cache key collision","id":"CVE-2026-35030","kev_date_added":null,"published":"2026-04-06"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CC BY 4.0","name":"PyPA Advisory Database","prefix":"PYSEC"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"open","licence":"CC0 1.0","name":"CISA KEV"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"},{"class":"attribution","licence":"BSD-3-Clause","name":"Metasploit"},{"class":"attribution","licence":"MIT","name":"Nuclei templates"},{"class":"open","licence":"CC0","name":"PoC-in-GitHub"}],"ssvc":{"automatable":"yes","exploitation":"active","technical_impact":"total"},"state":"PUBLISHED","updated":"2026-07-15","vendors":["BerriAI"]},"summary":"Unauthenticated attackers can exploit SQL injection in LiteLLM proxy API key verification to read and modify database contents, potentially compromising managed credentials.","url":"https://insights.sbomify.com/CVE-2026-42208/"}