{"id":"CVE-2026-42208","published":"2026-05-08T04:16:19Z","modified":"2026-10-26T20:10:00Z","title":"BerriAI LiteLLM SQL Injection Vulnerability","vendor":"BerriAI","product":"LiteLLM","tier":"core","eol":null,"description":{"text":"LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.81.16 to before version 1.83.7, a database query used during proxy API key checks mixed the caller-supplied key value into the query text instead of passing it as a separate parameter. An unauthenticated attacker could send a specially crafted Authorization header to any LLM API route (for example POST /chat/completions) and reach this query through the proxy's error-handling path. An attacker could read data from the proxy's database and may be able to modify it, leading to unauthorised access to the proxy and the credentials it manages. This issue has been patched in version 1.83.7.","provenance":"source","from":"NVD"},"summary":{"text":"A SQL injection flaw in BerriAI's LiteLLM proxy server (AI Gateway) arises because the API key validation query used during proxy authentication checks concatenates the caller-supplied key into the SQL text rather than passing it as a bound parameter. An unauthenticated remote attacker can exploit this by sending a crafted Authorization header to any LLM API route, such as POST /chat/completions, reaching the query through the error-handling path, which can expose or modify data in the proxy's database and the credentials it manages.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T08:31:55Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.8942,"percentile":0.99785,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2026-05-08","dueDate":"2026-05-11","ransomware":false,"requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://github.com/BerriAI/litellm/security/advisories/GHSA-r75f-5x8p-qvmc ; https://nvd.nist.gov/vuln/detail/CVE-2026-42208","provenance":"source"},"vulncheckKev":{"dateAdded":"2026-04-27","exploitedFirstSeen":"2026-04-27","ransomware":false,"evidence":[{"url":"https://webflow.sysdig.com/blog/cve-2026-42208-targeted-sql-injection-against-litellms-authentication-path-discovered-36-hours-following-vulnerability-disclosure","date":"2026-04-27"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2026-05-08"},{"url":"https://censys.com/blog/state-of-the-internet-2026-preview/","date":"2026-07-23"},{"url":"https://expel.com/blog/the-ai-cve-exploitation-evidence-story-headlines-are-scarier-than-reality/","date":"2026-08-27"}],"evidenceTotal":4,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 31, 2026","url":"https://otx.alienvault.com/pulse/6ae4aefab0c2191cecd41862","created":"2026-10-30"},{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"INC and The Gentlemen Ransomware: Exposed AI Infrastructure","url":"https://otx.alienvault.com/pulse/6ae254acfd783d5b63290659","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"INC and The Gentlemen Ransomware: Exposed AI Infrastructure","url":"https://otx.alienvault.com/pulse/6ad8db024c84442cd0085496","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"}],"provenance":"machine"},"cwes":[{"id":"CWE-89","name":"Improper Neutralization of Special Elements used in an SQL Command"}],"references":[{"url":"https://github.com/BerriAI/litellm/releases/tag/v1.83.7-stable","tags":["Product","Release Notes"]},{"url":"https://github.com/BerriAI/litellm/security/advisories/GHSA-r75f-5x8p-qvmc","tags":["Mitigation","Patch","Vendor Advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42208","tags":["Third Party Advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2463965","tags":["Mitigation","Third Party Advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42208.json","tags":["Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-42208","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Unauthenticated crafted HTTP request to public-facing app","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"An unauthenticated attacker could send a specially crafted Authorization header to any LLM API route","start":286,"end":386}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1005","name":"Data from Local System","tactics":["collection"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Attacker reads data from proxy database","mappingType":"primary_impact","evidence":[{"from":"description","quote":"An attacker could read data from the proxy's database","start":486,"end":539}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1565.001","name":"Stored Data Manipulation","tactics":["impact"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Database modification via injected query","mappingType":"primary_impact","evidence":[{"from":"description","quote":"may be able to modify it","start":544,"end":568}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[{"ecosystem":"PyPI","package":"litellm","vulnerableRanges":[">=1.81.16, <1.83.7"],"patched":["1.83.7"],"from":["GHSA-r75f-5x8p-qvmc","PYSEC-2026-391"],"provenance":"source"}],"advisories":[{"id":"GHSA-r75f-5x8p-qvmc","url":"https://github.com/advisories/GHSA-r75f-5x8p-qvmc","severity":"CRITICAL","ecosystem":"PyPI","package":"litellm","vulnerableRanges":[">=1.81.16, <1.83.7"],"patched":["1.83.7"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2026-28503","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-28503","exploited":true,"exploitedSince":"2026-05-08","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":4,"skipped":2,"earliest":"2026-04-28","earliestUrl":"https://github.com/imjdl/CVE-2026-42208_lab","repos":[{"name":"ridhinva/litellm-sqli-scanner","url":"https://github.com/ridhinva/litellm-sqli-scanner","stars":1,"created":"2026-05-22"},{"name":"imjdl/CVE-2026-42208_lab","url":"https://github.com/imjdl/CVE-2026-42208_lab","stars":0,"created":"2026-04-28"},{"name":"0xBlackash/CVE-2026-42208","url":"https://github.com/0xBlackash/CVE-2026-42208","stars":0,"created":"2026-05-03"},{"name":"Zeltoc/threat-intel-brief-cve-2026-42208-litellm","url":"https://github.com/Zeltoc/threat-intel-brief-cve-2026-42208-litellm","stars":0,"created":"2026-05-10"}]},"metasploit":[{"name":"BerriAI LiteLLM Proxy Pre-Auth SQL Injection Scanner","module":"auxiliary/scanner/http/litellm_proxy_sqli","type":"auxiliary","disclosureDate":"2026-04-20","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/litellm_proxy_sqli.rb"}],"nuclei":[{"id":"CVE-2026-42208","name":"LiteLLM - SQL Injection","severity":"critical","path":"http/cves/2026/CVE-2026-42208.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-42208.yaml"}],"first":{"date":"2026-04-20","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/litellm_proxy_sqli.rb"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1005","T1565.001"],"provenance":"ai"}],"timeline":[{"date":"2026-04-20","kind":"exploit-public","label":"First public exploit: Metasploit; later: PoC-in-GitHub 2026-04-28","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/litellm_proxy_sqli.rb","provenance":"source"},{"date":"2026-04-27","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://webflow.sysdig.com/blog/cve-2026-42208-targeted-sql-injection-against-litellms-authentication-path-discovered-36-hours-following-vulnerability-disclosure","provenance":"source"},{"date":"2026-05-08","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42208","provenance":"source"},{"date":"2026-05-08","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2026-05-08","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-28503","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":0},"priority":{"score":74.8,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":5.0,"detail":"added 187 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.96,"detail":"percentile 0.9979"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"4 PoC-in-GitHub repos; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}