CVE-2026-42208

critical

Description

LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.81.16 to before version 1.83.7, a database query used during proxy API key checks mixed the caller-supplied key value into the query text instead of passing it as a separate parameter. An unauthenticated attacker could send a specially crafted Authorization header to any LLM API route (for example POST /chat/completions) and reach this query through the proxy's error-handling path. An attacker could read data from the proxy's database and may be able to modify it, leading to unauthorised access to the proxy and the credentials it manages. This issue has been patched in version 1.83.7.

References

https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42208.json

https://bugzilla.redhat.com/show_bug.cgi?id=2463965

https://access.redhat.com/security/cve/CVE-2026-42208

https://webflow.sysdig.com/blog/how-attackers-are-jailbreaking-llms-with-ctf-framing-and-how-to-catch-them

https://thehackernews.com/2026/06/litellm-flaw-cve-2026-42271-exploited.html

https://securityaffairs.com/191964/security/u-s-cisa-adds-a-flaw-in-berriai-litellm-to-its-known-exploited-vulnerabilities-catalog.html

https://www.cisa.gov/news-events/alerts/2026/05/08/cisa-adds-one-known-exploited-vulnerability-catalog

https://www.securityweek.com/fresh-litellm-vulnerability-exploited-shortly-after-disclosure/

https://thehackernews.com/2026/04/litellm-cve-2026-42208-sql-injection.html

https://securityaffairs.com/191483/hacking/cve-2026-42208-litellm-bug-exploited-36-hours-after-its-disclosure.html

https://www.bleepingcomputer.com/news/security/hackers-are-exploiting-a-critical-litellm-pre-auth-sqli-flaw/

https://webflow.sysdig.com/blog/cve-2026-42208-targeted-sql-injection-against-litellms-authentication-path-discovered-36-hours-following-vulnerability-disclosure

https://github.com/shunfeng8421/exploit-library

https://github.com/Byungju/cve-research-lab

https://github.com/kenlacroix/palisade

https://github.com/HAERIN-L/poc_cve-2026-42208

https://github.com/Zeltoc/threat-intel-brief-cve-2026-42208-litellm

https://github.com/Turner-Levey/kev-deadline-planner

https://github.com/0xBlackash/CVE-2026-42208

https://github.com/pierce403/cvehunt

https://github.com/pduggusa/dugganusa-cli

https://github.com/gtamir02-png/cve-ai-agentdashboard

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-42208

https://github.com/advisories/GHSA-r75f-5x8p-qvmc

https://github.com/BerriAI/litellm/security/advisories/GHSA-r75f-5x8p-qvmc

https://github.com/BerriAI/litellm/releases/tag/v1.83.7-stable

Details

Source: Mitre, NVD

Published: 2026-05-08

Updated: 2026-07-15

Known Exploited Vulnerability (KEV)

Risk Information

CVSS v2

Base Score: 10

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Severity: Critical

CVSS v3

Base Score: 9.8

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Severity: Critical

CVSS v4

Base Score: 9.3

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Severity: Critical

EPSS

EPSS: 0.8942