CVE-2026-42208

BerriAI LiteLLM, an open-source proxy server (AI gateway) used to call LLM APIs in OpenAI or native format, contains a SQL injection (CWE-89) in the database query performed during proxy API key checks in versions 1.81.16 through before 1.83.7: the caller-supplied key value was mixed into the query text rather than passed as a parameter. An unauthenticated attacker triggers the flaw by sending a specially crafted Authorization header to any LLM API route (for example POST /chat/completions), reaching the vulnerable query through the proxy's error-handling path. Successful exploitation lets the attacker read data from the proxy's database and potentially modify it, leading to unauthorized access to the proxy and the API keys/credentials it manages; CVSS 4.0 rates it 9.3 (critical). Any organization running an affected LiteLLM proxy version is affected, particularly instances reachable over a network. Exploitation is confirmed in the wild: the flaw was reportedly exploited within 36 hours of disclosure, CISA added it to the Known Exploited Vulnerabilities catalog on 2026-05-08, and EPSS puts the 30-day exploitation probability at 89.4%.

What to do: Upgrade LiteLLM to version 1.83.7 or later immediately; exploitation began within 36 hours of disclosure, the flaw is in CISA's KEV catalog, and federal agencies must apply mitigations under BOD 22-01. Until patched, restrict network access to the proxy, and review proxy database logs for unexpected queries or unauthorized key usage; if compromise is suspected, rotate the API keys and credentials stored in the proxy database. Also check your exposure to the separately reported LiteLLM issue CVE-2026-42271, which is reported as exploited in the wild and chains to unauthenticated RCE.