Which versions of LiteLLM are affected by CVE-2026-42208?

LiteLLM proxy server versions 1.81.16-1.83.6 contain a critical SQL injection vulnerability accessible without authentication that allows attackers to read and modify database contents, including…. A patch is available.

Is there a public PoC exploit available for CVE-2026-42208?

Yes, a public proof-of-concept exploit is available for CVE-2026-42208. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-42208?

Within 24 hours: Identify all LiteLLM proxy instances running versions 1.81.16 through 1.83.6 using asset inventory and network scans. Within 7 days: Upgrade all affected instances to version 1.83.7 or later per vendor advisory; test in non-production environment first. Within 30 days: Audit database access logs for suspicious Authorization header patterns; rotate all LLM API credentials stored in affected instances; review access controls to LiteLLM proxy endpoints.

LiteLLM CVE-2026-42208

Q: What is the CVSS score of CVE-2026-42208?

CVE-2026-42208 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-28503 CRITICAL

SQL Injection (CWE-89)

2026-05-08 GitHub_M

GHSA-r75f-5x8p-qvmc

SQLi Litellm

9.3

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Red Hat

9.8 CRITICAL

qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Added to CISA KEV

May 08, 2026 - 17:18 CISA

Patch available

May 08, 2026 - 05:01 EUVD

Source Code Evidence Fetched

May 08, 2026 - 04:32 vuln.today

Analysis Generated

May 08, 2026 - 04:32 vuln.today

CVSS changed

May 08, 2026 - 04:22 NVD

9.3 (CRITICAL)

CVE Published

May 08, 2026 - 03:38 nvd

CRITICAL 9.3

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

8 pypi packages depend on litellm (8 direct, 0 indirect)

Ecosystem-wide dependent count for version 1.81.16.

DescriptionCVE.org

LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.81.16 to before version 1.83.7, a database query used during proxy API key checks mixed the caller-supplied key value into the query text instead of passing it as a separate parameter. An unauthenticated attacker could send a specially crafted Authorization header to any LLM API route (for example POST /chat/completions) and reach this query through the proxy's error-handling path. An attacker could read data from the proxy's database and may be able to modify it, leading to unauthorised access to the proxy and the credentials it manages. This issue has been patched in version 1.83.7.

Articles & Coverage 3

POC CVE-2026-42208: Critical Pre-Auth SQL Injection in LiteLLM AI Gateway May 04, 2026 blog.talosintelligence.com Great responsibility, without great power Apr 30, 2026 POC CVE-2026-42208: LiteLLM Proxy Critical SQL Injection in Authentication Callback Apr 28, 2026

AnalysisAI

SQL injection in LiteLLM proxy server versions 1.81.16 through 1.83.6 allows unauthenticated remote attackers to read and modify database contents, gaining unauthorized access to managed LLM API credentials. The vulnerability is exploitable via crafted Authorization headers sent to any LLM API route (e.g., POST /chat/completions), triggering the injection through the proxy's error-handling path. Vendor-released patch available in version 1.83.7. No active exploitation confirmed (not in CISA KEV), but the attack vector is simple (CVSS 4.0: AV:N/AC:L/PR:N) and SQL injection POCs are widely known. Discovered by Tencent YunDing Security Lab.

Technical ContextAI

LiteLLM is a proxy server (AI Gateway) that translates requests to various LLM APIs into OpenAI-compatible format. The vulnerability stems from CWE-89 (SQL Injection) where user-supplied API key values from the Authorization header are concatenated directly into SQL query text during API key verification, rather than being passed as parameterized values. The affected component is the proxy's authentication layer, specifically within the error-handling code path. CPE identifier cpe:2.3:a:berriai:litellm indicates this affects the Python package distributed via PyPI. The flaw violates secure coding practices for database interactions, allowing attackers to break out of the intended query logic and execute arbitrary SQL commands against the proxy's backend database, which stores sensitive credential data for managed LLM services.

RemediationAI

Upgrade to LiteLLM version 1.83.7 or later, available at https://github.com/BerriAI/litellm/releases/tag/v1.83.7-stable (patched release confirmed by vendor). The fix implements parameterized SQL queries for API key verification, eliminating the injection vector. For environments where immediate upgrade is not feasible, apply the vendor-recommended workaround: set disable_error_logs: true under general_settings in the LiteLLM configuration, which removes the error-handling code path through which unauthenticated input reaches the vulnerable query. Note this workaround may reduce operational visibility into authentication failures and should be considered temporary. After upgrading, rotate all LLM API credentials managed by the proxy, as attackers who previously exploited this vulnerability may have exfiltrated credential data. Docker users should verify image signatures using cosign per vendor instructions to ensure authenticity of the patched release.