CVE-2026-42208

Description

LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.81.16 to before version 1.83.7, a database query used during proxy API key checks mixed the caller-supplied key value into the query text instead of passing it as a separate parameter. An unauthenticated attacker could send a specially crafted Authorization header to any LLM API route (for example POST /chat/completions) and reach this query through the proxy's error-handling path. An attacker could read data from the proxy's database and may be able to modify it, leading to unauthorised access to the proxy and the credentials it manages. This issue has been patched in version 1.83.7.

Overview

State: PUBLISHED
Assigner (CNA): GitHub_M
CVSS severity: CRITICAL
CVSS score: 9.3 / 10
CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Effective score: 9.3 / 10 CRITICAL source: CNA overview
CWE(s): CWE-89
Reserved: 2026-04-25
Published: 2026-05-08 03:38 UTC
Last updated: 2026-05-09 03:55 UTC
Source: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/42xxx/CVE-2026-42208.json
Linked Threat: CVE-2026-42208 — BerriAI LiteLLM: BerriAI LiteLLM SQL Injection Vulnerability

CISA Known Exploited Vulnerabilities CISA KEV

CISA has confirmed in-the-wild exploitation of this CVE. Federal agencies must remediate by the due date below; private orgs should treat it as priority-1.

Vulnerability name: BerriAI LiteLLM SQL Injection Vulnerability
Vendor / project: BerriAI
Product: LiteLLM
Date added to KEV: 2026-05-08
Remediation due: 2026-05-11
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Ransomware campaign use: Unknown
CISA notes: https://github.com/BerriAI/litellm/security/advisories/GHSA-r75f-5x8p-qvmc ; https://nvd.nist.gov/vuln/detail/CVE-2026-42208
CISA listing: www.cisa.gov/known-exploited-vulnerabilities-catalog

NVD triage scoring NVD CVE 2.0

Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.

NVD published: 2026-05-08 04:16:19 UTC
NVD last modified: 2026-05-08 19:19:34 UTC
NVD CVSS v3.1: 9.8 / 10 CRITICAL source: nvd@nist.gov
NVD CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitability subscore: 3.9 / 10
Impact subscore: 5.9 / 10
EPSS score: 0.5426 (probability of exploitation in next 30 days)
EPSS percentile: 98.06% vs all CVEs — higher = more likely to be exploited, as of 2026-05-24

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID: EUVD-2026-28503
Assigner: GitHub_M
Published: May 8, 2026, 3:38:14 AM
Updated: May 9, 2026, 3:55:45 AM
EUVD base score (CVSS 4.0): 9.3 / 10
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EUVD-reported EPSS: 54.2600
Vendors: berriai
Products: LiteLLM (1.81.16, < 1.83.7)

LiteLLM (1.81.16, < 1.83.7)
Aliases: GHSA-r75f-5x8p-qvmc

ENISA description: LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.81.16 to before version 1.83.7, a database query used during proxy API key checks mixed the caller-supplied key value into the query text instead of passing it as a separate parameter. An unauthenticated attacker could send a specially crafted Authorization header to any LLM API route (for example POST /chat/completions) and reach this query through the proxy's error-handling path. An attacker could read data from the proxy's database and may be able to modify it, leading to unauthorised access to the proxy and the credentials it manages. This issue has been patched in version 1.83.7.

EUVD references (2)

Affected products (1)

Vendor	Product	Versions	Platforms
BerriAI	litellm	`>= 1.81.16, < 1.83.7` (affected)	—

Affected products — CPE 2.3 (1) NVD

NVD's normalized CPE 2.3 matchers, used by vendor tools (vulnerability scanners, asset managers) for automated detection. Compare with the CNA's free-text "Affected products" section above.

cpe:2.3:a:litellm:litellm:*:*:*:*:*:*:*:*

Vendor references (2)

References embedded in the original CVE record by the assigning CNA.

https://github.com/BerriAI/litellm/security/advisories/GHSA-r75f-5x8p-qvmc x_refsource_CONFIRM
https://github.com/BerriAI/litellm/releases/tag/v1.83.7-stable x_refsource_MISC

Web references (14)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

https://github.com/advisories/GHSA-r75f-5x8p-qvmc tenable:github.com
https://github.com/BerriAI/litellm/releases/tag/v1.83.7-stable tenable:github.com
https://github.com/BerriAI/litellm/security/advisories/GHSA-r75f-5x8p-qvmc tenable:github.com
https://nvd.nist.gov/vuln/detail/CVE-2026-42208 tenable:nvd.nist.gov
https://securityaffairs.com/191483/hacking/cve-2026-42208-litellm-bug-exploited-36-hours-after-its-disclosure.html tenable:securityaffairs.com
https://securityaffairs.com/191964/security/u-s-cisa-adds-a-flaw-in-berriai-litellm-to-its-known-exploited-vulnerabilities-catalog.html tenable:securityaffairs.com
https://thehackernews.com/2026/04/litellm-cve-2026-42208-sql-injection.html tenable:thehackernews.com
https://webflow.sysdig.com/blog/cve-2026-42208-targeted-sql-injection-against-litellms-authentication-path-discovered-36-hours-following-vulnerability-disclosure tenable:webflow.sysdig.com
https://www.bleepingcomputer.com/news/security/hackers-are-exploiting-a-critical-litellm-pre-auth-sqli-flaw/ tenable:www.bleepingcomputer.com
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-42208 tenable:www.cisa.gov
https://www.cisa.gov/news-events/alerts/2026/05/08/cisa-adds-one-known-exploited-vulnerability-catalog tenable:www.cisa.gov
https://www.cve.org/CVERecord?id=CVE-2026-42208 tenable:www.cve.org
https://www.first.org/epss/ tenable:www.first.org
https://www.securityweek.com/fresh-litellm-vulnerability-exploited-shortly-after-disclosure/ tenable:www.securityweek.com

NVD-tagged references (3)

Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.

https://github.com/BerriAI/litellm/releases/tag/v1.83.7-stable security-advisories@github.com ProductRelease Notes
https://github.com/BerriAI/litellm/security/advisories/GHSA-r75f-5x8p-qvmc security-advisories@github.com MitigationPatchVendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-42208 134c704f-9b21-4f2e-91b3-4a467353bcc0 US Government Resource

Indicators (2)

IOCs linked to the auto-promoted Threat row.

Type	Value	VirusTotal	Attached
cve	`CVE-2026-42208`	no local data	2026-05-14 02:58 UTC
cwe	`CWE-89`	no local data	2026-05-14 02:58 UTC

Remediations (9)

Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.

Patch Tuesday May 2026: Security Updates & CVE Analysis

web:zecurit.com

Get the complete breakdown of Microsoft's May 2026 Patch Tuesday. We analyze the latest security updates and all critical CVEs .

2026-05-14 03:24 UTC
CVE-2026-42208: LiteLLM bug exploited 36 hours after its disclosure

web:securityaffairs.com

Attackers quickly exploited a critical LiteLLM flaw ( CVE-2026-42208 ) to access and modify sensitive database data via SQL injection.

2026-05-14 03:24 UTC
CVE-2026-42208: Pre-Authentication SQL Injection in… | Bishop Fox

web:bishopfox.com

Bishop Fox confirms CVE-2026-42208 , a critical pre-auth SQL injection in LiteLLM proxy. Learn how it works, how to test for exposure, and how to patch it.

2026-05-14 03:24 UTC
May 2026 Patch Tuesday: no zero-days but plenty to fix

web:www.malwarebytes.com

May's Patch Tuesday may not be the giant release many expected, but there are still plenty of important fixes that shouldn't be ignored.

2026-05-14 03:24 UTC
Patch Tuesday: February 2026 Latest Patch Updates & Breakdown

web:www.manageengine.com

Unfold what this Patch Tuesday has in store for you Patch Tuesday, the unofficial term for Microsoft's scheduled security fix release on every second Tuesday of a month, has been a constant topic of discussion ever since its inception. Upcoming Webinar May 14,2026 11:30 EDT & 6:30 a.m. GMT Agenda of the Free Patch Tuesday webinar A complete breakdown of all the latest Patch Tuesday updates ...

2026-05-14 03:24 UTC
Microsoft Technical Security Notifications

web:www.microsoft.com

Security Update Guide Notifications Microsoft's free Security Update Guide Notifications provide links to security-related software updates and notification of re-released security updates. These notifications are sent via email throughout the month as needed.

2026-05-14 03:24 UTC
120 Vulnerabilities Patched: Microsoft's May 2026 Patch Tuesday ...

web:www.secpod.com

The second Tuesday of May 2026 marked another major security update release from Microsoft, addressing a broad range of vulnerabilities across Windows, Microsoft Office, SharePoint, Dynamics 365, .NET, DNS Client, and other core enterprise components. While this month's Patch Tuesday did not include any actively exploited or publicly disclosed zero-day vulnerabilities, the release still ...

2026-05-14 03:24 UTC
CVE-2026-42208: Targeted SQL injection against LiteLLM's authentication ...

web:www.sysdig.com

Critical vulnerability CVE-2026-42208 exposes LiteLLM to pre-auth SQL injection, enabling attackers to extract API keys and credentials. Sysdig analysis reveals targeted exploitation within 36 hours of disclosure.

2026-05-14 03:24 UTC
CISA Required Action

CISA KEV

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Due date: 2026-05-11 Known ransomware campaign use: Unknown

2026-05-14 01:13 UTC

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2026-42208.json.

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-42208",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-08T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2026-05-08",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-42208"
              },
              "type": "kev"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-09T03:55:45.157Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "government-resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-42208"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-05-08T00:00:00.000Z",
            "value": "CVE-2026-42208 added to CISA KEV"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "litellm",
          "vendor": "BerriAI",
          "versions": [
            {
              "status": "affected",
              "version": ">= 1.81.16, < 1.83.7"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.81.16 to before version 1.83.7, a database query used during proxy API key checks mixed the caller-supplied key value into the query text instead of passing it as a separate parameter. An unauthenticated attacker could send a specially crafted Authorization header to any LLM API route (for example POST /chat/completions) and reach this query through the proxy's error-handling path. An attacker could read data from the proxy's database and may be able to modify it, leading to unauthorised access to the proxy and the credentials it manages. This issue has been patched in version 1.83.7."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-08T03:38:14.124Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/BerriAI/litellm/security/advisories/GHSA-r75f-5x8p-qvmc",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/BerriAI/litellm/security/advisories/GHSA-r75f-5x8p-qvmc"
        },
        {
          "name": "https://github.com/BerriAI/litellm/releases/tag/v1.83.7-stable",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/BerriAI/litellm/releases/tag/v1.83.7-stable"
        }
      ],
      "source": {
        "advisory": "GHSA-r75f-5x8p-qvmc",
        "discovery": "UNKNOWN"
      },
      "title": "LiteLLM: SQL injection in Proxy API key verification"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-42208",
    "datePublished": "2026-05-08T03:38:14.124Z",
    "dateReserved": "2026-04-25T05:04:37.027Z",
    "dateUpdated": "2026-05-09T03:55:45.157Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}