LiteLLM CVE-2026-42208

No special conditions - remote unauthenticated exploitation against default configurations of LiteLLM proxy server versions 1.81.16-1.83.6. Attack requires only network access to any LiteLLM API endpoint (commonly exposed on TCP/8000 or via reverse proxy). Exploitation specifically requires triggering the error-handling code path during API key verification, achieved by sending requests with malformed or invalid Authorization headers that contain SQL injection payloads. The vendor workaround (disable_error_logs: true) explicitly blocks this attack path, limiting exploitation to installations running affected versions without this configuration change. Attack complexity is low (AC:L) as no race conditions, timing dependencies, or user interaction is required.

CVSS 4.0 score of 9.3 reflects critical severity with maximum exploitability (AV:N/AC:L/PR:N/UI:N) - remote unauthenticated attackers can exploit this without special conditions. However, real-world risk assessment reveals nuanced factors: the vulnerability requires reaching the error-handling path rather than normal authentication flow, which may limit exploitation to specific request patterns. No CISA KEV listing indicates no confirmed widespread exploitation at time of analysis. EPSS data not provided, but SQL injection vulnerabilities typically have moderate-to-high exploitation probability given mature tooling and attacker familiarity. High technical impact (VC:H/VI:H) is confirmed - attackers gain read/write access to credential databases. The attack is automatable once the specific payload pattern is identified. Scope is unchanged (SC:N/SI:N/SA:N), meaning impact is confined to the vulnerable LiteLLM proxy. Priority assessment: HIGH for organizations running affected versions with internet-facing LiteLLM proxies managing production LLM credentials; MEDIUM for internally-facing deployments with network segmentation; all should patch given the trivial exploit path and credential exposure risk.

An unauthenticated attacker crafts a malicious Authorization header containing SQL injection payloads (e.g., ' OR 1=1-- or UNION-based queries) and sends it to the LiteLLM proxy's /chat/completions endpoint or any other LLM API route. The proxy's error-handling path during API key verification concatenates this header value into a SQL query, allowing the attacker to execute arbitrary database commands. The attacker extracts stored LLM API keys (OpenAI, Anthropic, etc.) from the database, then uses these credentials to directly access LLM services, bypassing the proxy's usage controls and potentially incurring significant costs or accessing sensitive data processed by the LLMs. Publicly available SQL injection tools and techniques make exploitation straightforward once the vulnerable endpoint pattern is identified.