Read the docs
TI-2026-30529 Aliases CVE-2026-42208GHSA-r75f-5x8p-qvmc

LiteLLM: SQL injection in Proxy API key verification

Priority CRITICAL 99Exploited in the wildCWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
SQL injection
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-89.

Summary

LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.81.16 to before version 1.83.7, a database query used during proxy API key checks mixed the caller-supplied key value into the query text instead of passing it as a separate parameter. An unauthenticated attacker could send a specially crafted Authorization header to any LLM API route (for example POST /chat/completions) and reach this query through the proxy's error-handling path. An attacker could read data from the proxy's database and may be able to modify it, leading to unauthorised access to the proxy and the credentials it manages. This issue has been patched in version 1.83.7.

Why it matters now

Exploitation Active In CISA KEV since 2026-05-08CISA due date 2026-05-11
EPSS 0.8942 99th percentileScored 2026-11-07
Fix Fixed litellm (BerriAI): 1.83.7litellm (PyPI): 1.83.7

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Active
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
BerriAIlitellm1.81.16 to before 1.83.71.83.7Patch availableCNA
—litellm (PyPI)1.81.16 to before 1.83.71.83.7Patch availableGHSA-r75f-5x8p-qvmc
  • litellm VendorBerriAI Affected 1.81.16 to before 1.83.7 Fixed in 1.83.7 Patch available CNA
  • litellm (PyPI) Vendor— Affected 1.81.16 to before 1.83.7 Fixed in 1.83.7 Patch available GHSA-r75f-5x8p-qvmc

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:litellm:litellm:*:*:*:*:*:*:*:*1.81.16 to before 1.83.7VulnerableBerriAI
  • cpe:2.3:a:litellm:litellm:*:*:*:*:*:*:*:* Versions 1.81.16 to before 1.83.7 Vulnerable ·BerriAI

Remediation

  • Fix · CNA litellm (BerriAI) Fixed in 1.83.7
  • Fix · GHSA-r75f-5x8p-qvmc litellm (PyPI) Fixed in 1.83.7 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Critical. Red Hat's page for this CVE →

Not affected: 3 products
  • Lightspeed Core
  • Red Hat Ansible Automation Platform 2
  • Red Hat OpenShift AI (RHOAI)

Timeline

  1. 2026-05-08 Added to CISA KEV
  2. 2026-10-02 Threatist record created from CVE-2026-42208
  3. 2026-10-03 Alias added: GHSA-r75f-5x8p-qvmc
  4. 2026-10-05 5 new references · GHSA-r75f-5x8p-qvmc
  5. 2026-10-25 EPSS moved to the 99th percentile and above

References

Patch 1

Advisory 5

Other 5

  • TI-2026-26015 Trivy ecosystem supply chain briefly compromised KEVCVSS 4.0CRITICAL 9.4
  • TI-2026-30582 LiteLLM: Authenticated command execution via MCP stdio test endpoints KEVCVSS 4.0HIGH 8.7
  • TI-2026-42639 LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback KEVCVSS 4.0HIGH 8.8
  • TI-2024-05340 Remote Code Execution in BerriAI/litellm CVSS 3.1CRITICAL 9.8
  • TI-2024-02760 Server-Side Template Injection in BerriAI/litellm CVSS 3.0CRITICAL 9.8
  • TI-2026-34701 LiteLLM < 1.83.10 Privilege Escalation via User Update CVSS 4.0HIGH 8.7
See all 36 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences