U.S. CISA adds a flaw in BerriAI LiteLLM to its Known Exploited Vulnerabilities catalog
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-42208 | SQL Injection in BerriAI LiteLLM Proxy Exploited in the Wild BerriAI LiteLLM, an open-source proxy server (AI gateway) used to call LLM APIs in OpenAI or native format, contains a SQL injection (CWE-89) in the database query performed during proxy API key checks in versions 1.81.16 through before 1.83.7: the caller-supplied key value was mixed into the query text rather than passed as a parameter. An unauthenticated attacker triggers the flaw by sending a specially crafted Authorization header to any LLM API route (for example POST /chat/completions), reaching the vulnerable query through the proxy's error-handling path. Successful exploitation lets the attacker read data from the proxy's database and potentially modify it, leading to unauthorized access to the proxy and the API keys/credentials it manages; CVSS 4.0 rates it 9.3 (critical). Any organization running an affected LiteLLM proxy version is affected, particularly instances reachable over a network. Exploitation is confirmed in the wild: the flaw was reportedly exploited within 36 hours of disclosure, CISA added it to the Known Exploited Vulnerabilities catalog on 2026-05-08, and EPSS puts the 30-day exploitation probability at 89.4%. Do: Upgrade LiteLLM to version 1.83.7 or later immediately; exploitation began within 36 hours of disclosure, the flaw is in CISA's KEV catalog, and federal agencies must apply mitigations under BOD 22-01. Until patched, restrict network access to the proxy, and review proxy database logs for unexpected queries or unauthorized key usage; if compromise is suspected, rotate the API keys and credentials stored in the proxy database. Also check your exposure to the separately reported LiteLLM issue CVE-2026-42271, which is reported as exploited in the wild and chains to unauthenticated RCE. | 9.3 | 89% | KEV |
| largeroughly tens of thousands of self-hosted LiteLLM proxy deployments (exact counts unknown) |
Full article585 words · extracted from securityaffairs.com · click to collapse
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds a flaw in BerriAI LiteLLM to its Known Exploited Vulnerabilities catalog.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a flaw in BerriAI LiteLLM, tracked as CVE-2026-42208 (CVSS score of 9.3), to its Known Exploited Vulnerabilities (KEV) catalog.
At the end of April, attackers rapidly exploited the critical vulnerability in LiteLLM Python package just days after it became public. The vulnerability, an SQL injection in the proxy API key verification process, lets attackers access and potentially modify database data.
Instead of safely passing the key as a parameter, it directly inserts the user-supplied value into a database query. This unsafe practice opens the door to SQL injection.
An attacker doesn’t need valid credentials. By sending a specially crafted Authorization header to an API endpoint (such as /chat/completions), they can manipulate the query executed by the database. Because the request flows through an error-handling path, the malicious input still reaches the vulnerable query.
“A database query used during proxy API key checks mixed the caller-supplied key value into the query text instead of passing it as a separate parameter. An unauthenticated attacker could send a specially crafted Authorization header to any LLM API route (for example POST /chat/completions) and reach this query through the proxy’s error-handling path.” reads the BerriAI’s advisory. “An attacker could read data from the proxy’s database and may be able to modify it, leading to unauthorised access to the proxy and the credentials it manages.”
Researchers observed real-world attacks targeting sensitive information stored in database tables, highlighting how quickly disclosed flaws can turn into active threats.
The flaw affects LiteLLM versions 1.81.16 to 1.83.6 and was fixed in 1.83.7 on April 19, 2026. The Sysdig Threat Research Team reported that attackers began exploiting it about 36 hours after disclosure.
“The Sysdig Threat Research Team (TRT) observed the first exploitation attempt 36 hours and seven minutes after the advisory was published to the global database.” reads the report published by Sysdig. “The traffic the Sysdig TRT captured was not a generic SQLmap spray, which is very common in SQL injection attacks, but a deliberate, and likely customized, enumeration of the production LiteLLM schema, targeting the three tables that hold the highest-value secrets: virtual API keys, stored provider credentials, and the proxy’s environment-variable configuration.
The attacker showed strong knowledge of LiteLLM’s database structure and quickly mapped table schemas, but researchers saw no signs of data theft or further compromise.
“We did not see follow-through, however. There were no authenticated calls using exfiltrated keys, no virtual-key minting via /key/generate, and no chained reuse of provider credentials.” continues the report. “The novelty of this finding is the speed and precision of the schema-enumeration attempt, not a confirmed compromise.”
Sysdig published indicators of compromise for attacks exploiting this vulnerability.
Users who can’t upgrade their installs are suggested to enable disable_error_logs: true in general settings to block the attack path and reduce exposure.
According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.
Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure.
CISA orders federal agencies to fix the vulnerability by May 11, 2026.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, US CISA Known Exploited Vulnerabilities catalog)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/191964/security/u-s-cisa-adds-a-flaw-in-berriai-litellm-to-its-known-exploited-vulnerabilities-catalog.html