LiteLLM: SQL injection in Proxy API key verification
Title source: cnaExploitation Summary
CVE-2026-42208 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added May 8, 2026. EIP tracks 8 public exploits from researchers including yendpoint, HAERIN-L, ridhinva. A Nuclei detection template is also available.
AI-analyzed exploit summary This repository contains a functional timing-based PoC for CVE-2026-42208, targeting LiteLLM's PostgreSQL injection vulnerability. The exploit uses pg_sleep() to detect SQL injection via timing delays in the Authorization header.
Description
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.81.16 to before version 1.83.7, a database query used during proxy API key checks mixed the caller-supplied key value into the query text instead of passing it as a separate parameter. An unauthenticated attacker could send a specially crafted Authorization header to any LLM API route (for example POST /chat/completions) and reach this query through the proxy's error-handling path. An attacker could read data from the proxy's database and may be able to modify it, leading to unauthorised access to the proxy and the credentials it manages. This issue has been patched in version 1.83.7.
Exploits (8)
This repository contains a functional timing-based PoC for CVE-2026-42208, targeting LiteLLM's PostgreSQL injection vulnerability. The exploit uses pg_sleep() to detect SQL injection via timing delays in the Authorization header.
This repository contains a functional exploit PoC for CVE-2026-42208, a pre-auth SQL injection vulnerability in LiteLLM. The exploit demonstrates a time-based blind SQL injection using pg_sleep, targeting the token validation logic in LiteLLM's proxy server.
This repository contains a Python-based scanner for detecting SQL injection vulnerabilities (CVE-2026-42208) in LiteLLM Proxy instances. It includes fingerprinting, endpoint discovery, and SQLi payload testing but does not include functional exploit code for achieving RCE or other offensive actions.
This repository contains a Python-based scanner designed to detect SQL injection vulnerabilities in BerriAI LiteLLM proxy instances by testing various endpoints with predefined SQLi payloads. It includes functionality for endpoint discovery, LiteLLM instance fingerprinting, and basic SQL injection detection.
This repository contains a functional timing-based SQL injection PoC for CVE-2026-42208, targeting LiteLLM Proxy versions 1.81.16 to 1.83.6. The exploit uses a crafted `Authorization: Bearer` header with a `pg_sleep()` payload to demonstrate the vulnerability via response timing differences.
This repository provides a detailed technical analysis of CVE-2026-42208, a critical SQL injection vulnerability in BerriAI LiteLLM versions >= 1.81.16 and < 1.83.7. It includes root cause analysis, exploitation timeline, impact assessment, and detection recommendations.
The repository contains only a minimal README with incorrect CVE numbering (CVE-2026-40487 instead of CVE-2026-42208) and no exploit code or technical details.
This repository contains a functional proof-of-concept exploit for CVE-2026-42208, demonstrating a SQL injection vulnerability in LiteLLM Proxy's error-handling callback path. The exploit uses a time-based blind SQL injection technique via PostgreSQL's pg_sleep function to confirm vulnerability.
Nuclei Templates (1)
http.title:"LiteLLM"
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H