BerriAI · LiteLLM
A SQL injection flaw in BerriAI's LiteLLM proxy server (AI Gateway) arises because the API key validation query used during proxy authentication checks concatenates the caller-supplied key into the SQL text rather than passing it as a bound parameter. An unauthenticated remote attacker can exploit this by sending a crafted Authorization header to any LLM API route, such as POST /chat/completions, reaching the query through the error-handling path, which can expose or modify data in the proxy's database and the credentials it manages.
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.81.16 to before version 1.83.7, a database query used during proxy API key checks mixed the caller-supplied key value into the query text instead of passing it as a separate parameter. An unauthenticated attacker could send a specially crafted Authorization header to any LLM API route (for example POST /chat/completions) and reach this query through the proxy's error-handling path. An attacker could read data from the proxy's database and may be able to modify it, leading to unauthorised access to the proxy and the credentials it manages. This issue has been patched in version 1.83.7.
First seen exploited 11 days before it was disclosed. Public exploit code (Metasploit) was available 18 days before disclosure.
CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.
Unauthenticated crafted HTTP request to public-facing app
An unauthenticated attacker could send a specially crafted Authorization header to any LLM API route
Attacker reads data from proxy database
An attacker could read data from the proxy's database
Database modification via injected query
may be able to modify it
CVE-specific rules are not available in this build. Search SigmaHQ ↗
These detect the technique in general, not this specific vulnerability.
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
1 package in 1 ecosystem. Main package: litellm.
Upgrade to 1.84.0 or later
Fixes this CVE and 5 other known vulnerabilities in this package (CVE-2026-35029, CVE-2026-40217, +3).
pip install "litellm>=1.84.0"First fixed in 1.83.7 for CVE-2026-42208.
| If you run | Upgrade to |
|---|---|
| 1.81.16 up to 1.83.7 | 1.84.0first fix for this CVE: 1.83.7 |
“Up to” means the second version is the fix and is not affected.
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.