LiteLLM: SQL injection in Proxy API key verification
CVE-2026-42208 has a selected CVSS score of 9.3 (critical); EIP currently links 1 catalogued exploit, 6 repository PoCs, 1 curated repository PoC, 1 Nuclei template, and 3 lab environments. CISA lists CVE-2026-42208 in KEV.
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.81.16 to before version 1.83.7, a database query used during proxy API key checks mixed the caller-supplied key value into the query text instead of passing it as a separate parameter. An unauthenticated attacker could send a specially crafted Authorization header to any LLM API route (for example POST /chat/completions) and reach this query through the proxy's error-handling path. An attacker could read data from the proxy's database and may be able to modify it, leading to unauthorised access to the proxy and the credentials it manages. This issue has been patched in version 1.83.7.
CISA Coordinator · SSVC 2.0.3 · Evaluated May 8, 2026 · Source: CVE List
| Product | Source | Version range | Status |
|---|---|---|---|
LiteLLMBrowse BerriAI / LiteLLM | CISA, CVE List | >= 1.81.16, < 1.83.7 | affected |
Default status: unaffected | CVE List | Version data not supplied | |
Red Hat Ansible Automation Platform 2Browse Red Hat / Red Hat Ansible Automation Platform 2ansible-automation-platform-26/lightspeed-chatbot-rhel9Default status: unaffected | CVE List | Version data not supplied | |
Red Hat OpenShift AI (RHOAI)Browse Red Hat / Red Hat OpenShift AI (RHOAI)rhoai/odh-llama-stack-core-rhel9Default status: unaffected | CVE List | Version data not supplied | |
Default status: unaffected | CVE List | Version data not supplied | |
litellmBrowse PyPI / litellm | GitHub Advisory | 1.81.16 to < 1.83.7 · Fixed in 1.83.7 | affected |
A Metasploit auxiliary module that detects BerriAI LiteLLM proxy servers vulnerable to CVE-2026-42208 using a benign time-based blind SQL injection check. It sends two requests with different injected predicates and flags the target only when the first is delayed and the second is not, without reading or exfiltrating data.
No backdoor observed in reviewed code
The module is a scanner for CVE-2026-42208. It performs a benign time-based SQL injection check using the framework's PostgreSQLi::TimeBasedBlind library, issues two requests (one with a tautology, one without), and reports vulnerable only when the first is delayed and the second is not. No data exfiltration, persistence, credential theft, or unrelated payload delivery is present. The code is straightforward and matches the documented purpose.
The module's description and source code state it only detects the vulnerability using a time-based check without exploiting it to read or modify data. The check method returns a vulnerability status, and the module is classified as an auxiliary scanner in Metasploit.
modules/auxiliary/scanner/http/litellm_proxy_sqli.rb:16-17modules/auxiliary/scanner/http/litellm_proxy_sqli.rb:28-34modules/auxiliary/scanner/http/litellm_proxy_sqli.rb:127-134modules/auxiliary/scanner/http/litellm_proxy_sqli.rb:36-41modules/auxiliary/scanner/http/litellm_proxy_sqli.rb:107-125modules/auxiliary/scanner/http/litellm_proxy_sqli.rb:28-33modules/auxiliary/scanner/http/litellm_proxy_sqli.rb:28-34modules/auxiliary/scanner/http/litellm_proxy_sqli.rb:55modules/auxiliary/scanner/http/litellm_proxy_sqli.rb:107-125modules/auxiliary/scanner/http/litellm_proxy_sqli.rb:114-123modules/auxiliary/scanner/http/litellm_proxy_sqli.rb:144-150This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
A Python script that probes a target URL for accessible LiteLLM endpoints and attempts basic SQL injection payloads on public endpoints to detect potential CVE-2026-42208 exposure. It does not exploit the vulnerability to read or modify data.
No backdoor observed in reviewed code
The supplied PoC is a Python script that scans a target URL for LiteLLM endpoints and tests for SQL injection using hardcoded payloads. It performs only the advertised vulnerability scanning behavior: sending HTTP GET requests to known LiteLLM paths and appending SQLi payloads to query parameters. No backdoor, deceptive payload, persistence, credential theft, or unrelated remote access behavior is present in the reviewed evidence.
The script is explicitly described as a 'Vulnerability Scanner' in its banner and docstring. It probes endpoints and sends SQLi payloads to detect potential vulnerability, but does not extract, exfiltrate, or modify data. It only reports findings, which is characteristic of a scanner.
ridhinva-litellm-scanner-1c26469/litellm_scanner.py:3-5ridhinva-litellm-scanner-1c26469/litellm_scanner.py:11-14ridhinva-litellm-scanner-1c26469/litellm_scanner.py:72-82ridhinva-litellm-scanner-1c26469/litellm_scanner.py:45-49ridhinva-litellm-scanner-1c26469/litellm_scanner.py:52-53ridhinva-litellm-scanner-1c26469/litellm_scanner.py:56-62ridhinva-litellm-scanner-1c26469/litellm_scanner.py:87-90ridhinva-litellm-scanner-1c26469/litellm_scanner.py:1-96This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
The artifact is a time-based blind SQL injection scanner for CVE-2026-42208 in LiteLLM Proxy. It sends a crafted Authorization header to trigger a vulnerable error-handling path and measures response time to detect if a pg_sleep payload executed, indicating the target is vulnerable.
No backdoor observed in reviewed code
The PoC demonstrates a time-based blind SQL injection against a vulnerable LiteLLM proxy. The Python script sends crafted HTTP requests with a SQL payload in the Authorization header and measures response time to confirm the vulnerability. No backdoor, deceptive payload, or concealed operator-directed harm is present.
The Python script sends a crafted request to trigger a SQL injection and uses timing analysis to detect if the injection succeeded. It does not extract data, modify the database, or establish a foothold; it only reports whether the target is vulnerable. This is consistent with a scanner.
poc_litellm_sqli.py:2-6poc_litellm_sqli.py:103-108README.md:12README.md:40poc_litellm_sqli.py:42-43poc_litellm_sqli.py:78poc_litellm_sqli.py:87poc_litellm_sqli.py:34-36poc_litellm_sqli.py:97-101poc_litellm_sqli.py:103-113poc_litellm_sqli.py:34-36poc_litellm_sqli.py:39-51poc_litellm_sqli.py:76-113This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
The artifact contains a Python script that sends a crafted HTTP request to a LiteLLM endpoint to test for a pre-authentication SQL injection vulnerability (CVE-2026-42208). It does not extract data or establish a foothold; it only checks for error-based indicators of the vulnerability.
No backdoor observed in reviewed code
The PoC script (CVE-2026-42208.py) sends a user-supplied SQL payload in an Authorization header to a target LiteLLM instance and prints the response. It contains no backdoor, persistence, credential exfiltration, or unrelated payload. The README.md is a static description of the vulnerability. No deceptive or concealed harmful behavior is present.
The Python script is designed to test for the presence of a SQL injection vulnerability by sending a crafted request and observing the response for error indicators. It does not contain logic to extract, modify, or delete data, nor does it establish a shell or persistent access. The script's own description calls it a 'Safe demonstration script (read-only by default)' and a 'demonstration only'.
CVE-2026-42208.py:3-4CVE-2026-42208.py:65CVE-2026-42208.py:7-8README.md:22CVE-2026-42208.py:29-46CVE-2026-42208.py:51-56CVE-2026-42208.py:65CVE-2026-42208.py:29-46CVE-2026-42208.py:46CVE-2026-42208.py:69-70This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
A threat intelligence brief describing CVE-2026-42208, a critical SQL injection vulnerability in BerriAI LiteLLM. The document provides an executive summary, vulnerability details (root cause, attack path), exploitation timeline, impact assessment, detection opportunities, and recommended actions. It contains no exploit or scanner code.
No backdoor observed in reviewed code
The artifact is a single payload withheld file containing a threat intelligence brief about CVE-2026-42208. It is a static document with no executable code, no instructions for the reader to perform any action beyond standard security remediation, and no concealed or deceptive payloads. The content is purely informational.
The artifact is a threat intelligence brief (payload withheld) that provides a technical analysis of CVE-2026-42208, including vulnerability details, impact, and detection guidance. It does not contain any executable code, exploit scripts, or scanner logic. The content is purely descriptive and analytical, fitting the definition of a writeup.
README.md:1-160README.md:77README.md:31-38README.md:40-46README.md:94-111README.md:1-160README.md:1-160This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
A timing-based scanner that detects CVE-2026-42208, a SQL injection vulnerability in LiteLLM Proxy, by sending a crafted Authorization header containing a pg_sleep() payload and comparing response times against a baseline. It does not extract or modify data.
No backdoor observed in reviewed code
The reviewed evidence consists of a README and a Python PoC script for CVE-2026-42208. The PoC sends crafted HTTP requests to a target LiteLLM instance to demonstrate a timing-based SQL injection vulnerability. The code performs only HTTP POST requests with a pg_sleep() payload and a baseline request, measures response times, and prints a verdict. No backdoor, concealed executable behavior, persistence, credential theft, or unrelated payload is present. The artifact's behavior is limited to the described vulnerability demonstration.
The artifact's primary operation is to detect the presence of a vulnerability by observing timing differences without exploiting it to gain unauthorized access or extract data. The README explicitly states the PoC 'does not dump database data and does not modify database data' and uses a 'least-harm' timing proof. The code sends a payload and interprets the response time to report a vulnerability status, which is characteristic of a scanner.
README.md:7README.md:209-211poc/poc.py:156-164README.md:3README.md:5poc/poc.py:172-176poc/poc.py:72-99poc/poc.py:102-138poc/poc.py:141-164README.md:21README.md:22README.md:27poc/poc.py:110This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
A Python-based scanner that detects CVE-2026-42208, a SQL injection vulnerability in LiteLLM Proxy, by fingerprinting the target, discovering endpoints, and sending SQL injection payloads to check for error-based and time-based responses.
No backdoor observed in reviewed code
The repository contains a Python-based scanner for CVE-2026-42208, a SQL injection vulnerability in LiteLLM Proxy. The code performs network requests to a user-supplied target to fingerprint the service, discover endpoints, and test for SQL injection using a set of predefined payloads. No backdoor, concealed operator-directed harm, persistence mechanism, or unrelated payload was observed. The tool's behavior is consistent with its stated purpose as a security scanner.
The artifact's primary operation is to detect and validate the presence of CVE-2026-42208 by sending probe requests and analyzing responses for error patterns or time delays, without extracting data, modifying the database, or establishing a foothold. The README explicitly states it 'Detects and validates CVE-2026-42208' and the code only reports findings, consistent with a scanner.
README.md:5litellm_scanner.py:3-4litellm_scanner.py:183-267README.md:17requirements.txt:1-2README.md:22litellm_scanner.py:109-159litellm_scanner.py:161-181litellm_scanner.py:183-267litellm_scanner.py:212-265litellm_scanner.py:98-107litellm_scanner.py:300-312litellm_scanner.py:116litellm_scanner.py:204-210litellm_scanner.py:69-83litellm_scanner.py:300-312This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
The artifact provides a Nuclei template and a lab environment to detect CVE-2026-42208, a SQL injection vulnerability in LiteLLM. The primary code is a scanner that checks for the vulnerability via time-based detection without exploiting it for data access or modification.
No backdoor observed in reviewed code
The reviewed evidence consists of a README and a Nuclei template for CVE-2026-42208. The README documents a legitimate proof-of-concept lab for a known SQL injection vulnerability, and the Nuclei template provides a detection rule. No backdoor, deceptive payload, or concealed harmful behavior is present in the supplied text.
The Nuclei template (nuclei/CVE-2026-42208.yaml) sends crafted requests and uses response status and timing to detect the presence of the vulnerability. It does not extract, modify, or delete data; it only confirms the injection is possible. The accompanying scripts set up a lab and trigger the same time-based check, which is a detection mechanism, not an exploitation payload.
nuclei/CVE-2026-42208.yaml:1-61README.md:89-111README.md:14-15README.md:42README.md:44nuclei/CVE-2026-42208.yaml:37-42nuclei/CVE-2026-42208.yaml:44-50nuclei/CVE-2026-42208.yaml:55-61README.md:20-35nuclei/CVE-2026-42208.yaml:44-50nuclei/CVE-2026-42208.yaml:44-50This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
A Docker Compose environment that runs two isolated LiteLLM stacks (vulnerable v1.83.6-nightly and patched v1.83.7-stable) with dedicated PostgreSQL 15 databases, designed to demonstrate CVE-2026-42208, a pre-authentication SQL injection vulnerability.
docker-compose.yaml:1-56README.md:1-10The README explicitly states the environment is a lab for reproducing and detecting CVE-2026-42208. The Compose file defines vulnerable and patched LiteLLM services with corresponding databases, and the scripts provide setup, exploit, and teardown steps for a timing-based SQL injection proof-of-concept.
README.md:1-3docker-compose.yaml:1-56scripts/02-exploit.sh:1-73A PostgreSQL 15 Alpine container with database litellm_vuln, user litellm, and password litellm_pass. It stores LiteLLM data including the VerificationToken table required for the SQL injection to fire.
docker-compose.yaml:2-14A PostgreSQL 15 Alpine container with database litellm_patched, user litellm, and password litellm_pass. It serves the patched LiteLLM instance and is isolated from the vulnerable database.
docker-compose.yaml:16-28Runs LiteLLM v1.83.6-nightly on port 8010, connected to db-vuln. It contains the unsanitized SQL query path that allows pre-authentication SQL injection via the Authorization Bearer token.
docker-compose.yaml:30-42README.md:20-30Runs LiteLLM v1.83.7-stable on port 8011, connected to db-patched. It uses parameterized queries, preventing the SQL injection.
docker-compose.yaml:44-56README.md:32-35Starts all containers with docker compose up -d, waits for health checks, and creates a seed virtual key in each LiteLLM instance to ensure the VerificationToken table has at least one row, which is required for the pg_sleep injection to execute.
scripts/01-setup.sh:1-68Sends a baseline request and a request with a pg_sleep(6) SQL injection payload in the Authorization header to both the vulnerable and patched instances. Measures response time to confirm the injection on the vulnerable instance and the absence of delay on the patched instance.
scripts/02-exploit.sh:1-73Stops and removes all containers and deletes the persistent database volume directories.
scripts/99-teardown.sh:1-21Supported by supplied evidence
The lab explicitly targets CVE-2026-42208. The README describes the vulnerability as a pre-authentication SQL injection in LiteLLM versions >=1.81.16, <1.83.7, and the Compose file uses the affected version v1.83.6-nightly for the vulnerable service and the patched version v1.83.7-stable for the control. The exploit script demonstrates a timing-based blind SQL injection using pg_sleep, consistent with the described vulnerability.
README.md:1-3README.md:7-15docker-compose.yaml:30-42scripts/02-exploit.sh:8-12README.md:67-69README.md:67-69scripts/01-setup.sh:30-44README.md:73-75scripts/01-setup.sh:1-68README.md:89-91scripts/02-exploit.sh:1-73README.md:107-112README.md:120-122scripts/99-teardown.sh:1-21All visible behavior is directed at the lab's own target containers. The exploit script sends HTTP requests to localhost:8010 and localhost:8011, which are the vulnerable and patched LiteLLM instances defined in the Compose file. The setup script starts containers and creates a seed key, and the teardown script stops containers and removes local data directories. No evidence shows host escape, external connections, persistence beyond the lab, credential theft, or destructive behavior outside the lab boundary.
scripts/02-exploit.sh:4-5scripts/01-setup.sh:14-15scripts/99-teardown.sh:12-15This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.
A local Docker lab comparing a vulnerable LiteLLM instance (v1.83.6-nightly) and a patched instance (v1.83.7-stable) to demonstrate CVE-2026-42208, a pre-authentication SQL injection vulnerability. The lab uses a timing-based proof with pg_sleep() and does not dump or modify database data.
README.md:1-3docker-compose.yml:1-92The README explicitly states the repository is a 'Local Docker lab and least-harm PoC for CVE-2026-42208' and describes a comparison between vulnerable and patched LiteLLM instances using a timing-based SQL injection proof. The docker-compose.yml defines two separate stacks (vuln and patched) with distinct images and configurations, consistent with a vulnerability research environment.
README.md:1-3docker-compose.yml:1-92PostgreSQL 16-alpine database service for the vulnerable LiteLLM instance. It is internal to the Docker network and not exposed to the host. It uses a named volume for data persistence.
docker-compose.yml:2-14PostgreSQL 16-alpine database service for the patched LiteLLM instance. It is internal to the Docker network and not exposed to the host. It uses a named volume for data persistence.
docker-compose.yml:16-28LiteLLM proxy built from the vulnerable image ghcr.io/berriai/litellm-database:v1.83.6-nightly. It depends on db-vuln, exposes port 8081 on the host, and is configured with a master key and database URL. It serves as the target for the SQL injection proof.
docker-compose.yml:30-56vuln/Dockerfile:1-7LiteLLM proxy built from the patched image ghcr.io/berriai/litellm:v1.83.7-stable. It depends on db-patched, exposes port 8082 on the host, and is configured with a master key and database URL. It serves as a control to show the vulnerability is fixed.
docker-compose.yml:58-84patched/Dockerfile:1-7A Python script that sends a crafted Authorization header containing a SQL injection payload with pg_sleep() to a target URL. It measures response times to determine if the target is vulnerable. It does not dump or modify database data.
poc/poc.py:1-236Supported by supplied evidence
The README explicitly associates the lab with CVE-2026-42208, describing it as a pre-authentication SQL injection in LiteLLM Proxy. The docker-compose.yml sets up vulnerable (v1.83.6-nightly) and patched (v1.83.7-stable) instances, and the PoC script demonstrates a timing-based SQL injection using pg_sleep(). The evidence is consistent with the CVE description.
README.md:1-3README.md:9-11poc/poc.py:1-10README.md:73-75README.md:75README.md:79-81README.md:79-81README.md:83-91README.md:97-99README.md:101-103README.md:131-175The lab is explicitly scoped for local, authorized testing. The PoC uses a least-harm timing proof with pg_sleep() and does not dump, modify, or exfiltrate database data. No behavior targets the host, external systems, or persists beyond the lab. Port mappings and privileged mode are not used. The README includes safety notes warning against unauthorized use.
README.md:5-7README.md:185-189README.md:253-261poc/poc.py:5-10This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.
A Docker Compose environment running LiteLLM Proxy v1.83.3-stable with a PostgreSQL 16 backend, configured for demonstrating a SQL injection vulnerability.
docker-compose.yaml:1-28README.md:1-113The README explicitly describes a reproduction environment for a SQL injection vulnerability (GHSA-r75f-5x8p-qvmc) in LiteLLM Proxy, and the included PoC script targets the local service to demonstrate the vulnerability.
README.md:1-3README.md:5-10poc_litellm_sqli.py:1-6PostgreSQL 16 database service with healthcheck, exposed on port 5432, used by the LiteLLM service.
docker-compose.yaml:2-12LiteLLM Proxy v1.83.3-stable, configured with a bind-mounted config file and environment variables for database connection and master key. Exposed on port 4000.
docker-compose.yaml:14-28Configuration file for LiteLLM, defining a model list and general settings referencing environment variables.
litellm_config.yaml:1-9Python script that sends crafted HTTP requests to the LiteLLM service to trigger a time-based blind SQL injection via the error-handling callback path.
poc_litellm_sqli.py:1-117Insufficient evidence
The README states 'CVE: Pending' and the repository name suggests CVE-2026-42208, but no CVE record or official assignment is present in the supplied evidence. The advisory referenced is GHSA-r75f-5x8p-qvmc.
README.md:5-10poc_litellm_sqli.py:20README.md:33-35README.md:39-41README.md:33-35README.md:39-41README.md:43-65All visible behavior is directed at the local lab target (LiteLLM service on localhost:4000) to demonstrate the SQL injection vulnerability. No host escape, external connections, persistence, credential theft, or destructive actions are observed.
poc_litellm_sqli.py:1-117docker-compose.yaml:1-28This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.
LiteLLM 1.81.16 to < 1.83.7 contains a SQL injection caused by improper handling of caller-supplied key in database query during proxy API key checks, letting unauthenticated attackers read and modify database data, exploit requires crafted Authorization header.
Unauthenticated attackers can read and modify proxy database, leading to unauthorized access and credential compromise.
Upgrade to version 1.83.7 or later.
Source: ProjectDiscovery
Bishop Fox researchers reproduced and confirmed CVE-2026-42208, a critical pre-authentication SQL injection in BerriAI's LiteLLM proxy (versions 1.81.16 through 1.83.6). The vulnerability resides in an internal helper that resolves bearer tokens to virtual-key records, where a single missing parameter binding in an f-string SQL query allows an unauthenticated attacker to inject arbitrary SQL into the proxy's PostgreSQL backend. The flaw is reachable from any LLM API route without credentials. Because the response body is always HTTP 401 with a fixed JSON error, exploitation uses a time-based blind channel via PostgreSQL's pg_sleep(). Two distinct code paths reach the same SQL sink: one through Python assert stripping (-O flag) and one through the auth failure callback path where an AssertionError is caught by a generic handler that re-introduces the unsanitized input into a database lookup six call frames away. The patch in v1.83.7 replaced the f-string interpolation with a positional placeholder ($1) and rewrote the deprecated-token lookup using Prisma's typed find_first() API. Sysdig observed targeted in-the-wild exploitation attempts within 36 hours of advisory publication, with operators performing deliberate schema enumeration of high-value tables (virtual API keys, stored provider credentials, environment-variable configuration) rather than generic SQLmap spraying; Sysdig did not observe successful authenticated follow-on exploitation.