BerriAI LiteLLM Pre-Auth SQL Injection in Proxy API Key Verification — CVE-2026-42208 (CISA KEV, Active Exploitation)

BerriAI LiteLLM Pre-Auth SQL Injection in Proxy API Key (TL-2026-0487), also tracked as GHSA-r75f-5x8p-qvmc, is a critical-severity software vulnerability scored CVSS 9.8, first published 2026-05-08. It has no confirmed attribution, affects BerriAI LiteLLM, references 1 CVE (CVE-2026-42208), maps to 19 MITRE ATT&CK techniques (T1078, T1082, T1119), and is covered by 9 detection rules and 13 indicators of compromise.

Key facts for TL-2026-0487

Threat ID
TL-2026-0487
Also known as
GHSA-r75f-5x8p-qvmc, BerriAI LiteLLM SQL Injection Vulnerability
Severity
CRITICAL
CVSS
9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-05-08
Last reviewed
2026-05-08
Attribution confidence
NONE
Motivation
FINANCIAL
Target sectors
technology, saas, financial-services, healthcare, government, education, research, ai-mlops
Target regions
Global, North America, Europe, Asia-Pacific
Detection rules
9
Indicators of compromise
13

Malware and tooling in BerriAI LiteLLM Pre-Auth SQL Injection in Proxy API Key

Malware and tooling: BerriAI LiteLLM Proxy (AI Gateway)

CISA added CVE-2026-42208 to the Known Exploited Vulnerabilities catalog on 2026-05-08 based on evidence of active exploitation. The flaw is an unauthenticated SQL injection (CWE-89) in BerriAI LiteLLM, an AI gateway proxy widely deployed to broker calls to OpenAI, Anthropic, Azure OpenAI, Bedrock, and other LLM providers. A token-lookup query against the LiteLLM_VerificationTokenView combined view interpolated the caller-supplied token into the SQL string with a Python f-string instead of a parameterized placeholder, and the proxy's error-handling path routed crafted Authorization headers through that query. An unauthenticated attacker can send a single HTTP request to any LLM API route (e.g., POST /chat/completions) and read or modify the proxy database — including all stored provider API keys, virtual key hashes, team and organization tables, and budget records.

How BerriAI LiteLLM Pre-Auth SQL Injection in Proxy API Key works

BerriAI LiteLLM is an open-source AI gateway proxy that brokers requests across dozens of LLM providers (OpenAI, Anthropic, Azure OpenAI, AWS Bedrock, Google Vertex, Cohere, Mistral, etc.) using a single OpenAI-compatible API surface. The proxy authenticates inbound requests with virtual API keys whose hashed values are stored in a PostgreSQL table fronted by the LiteLLM_VerificationTokenView combined view. CVE-2026-42208 is a critical pre-authentication SQL injection in the proxy's token verification path.

Root cause: in litellm/proxy/utils.py around line 3016, the get_data() method built the verification query using an f-string — `WHERE v.token = ''{token}''` — and passed the resulting string to db.query_first() with no parameter binding. Although the proxy normally hashes the caller-supplied bearer token before lookup, the proxy's error-handling path could surface unhashed or partially-controlled input back into this query, allowing an attacker who sent a specially crafted Authorization header to inject arbitrary SQL. The fix (PR #25467, merged 2026-04-10) rewrites the query to use a parameterized placeholder — `WHERE v.token = $1` — and passes the hashed_token as a separate argument, eliminating the injection sink.

Exploitation: a single HTTP request to any LLM API route exposed by the proxy (POST /chat/completions, /embeddings, /v1/responses, /completions, /models, etc.) carrying a malicious Authorization: Bearer <payload> header is sufficient. No prior account, valid virtual key, network access, or user interaction is required. CVSS v3.1 = 9.8, CVSS v4.0 = 9.3. The discovery is credited to Tencent YunDing Security Lab; the maintainer fix was authored and merged by GitHub user jaydns.

Impact: LiteLLM proxies act as a single point of credential aggregation in modern AI stacks. A successful SQLi yields the entire LiteLLM_VerificationToken table (every virtual key issued to internal teams), the LiteLLM_TeamTable / LiteLLM_OrganizationTable / LiteLLM_ProjectTable rows (tenant boundaries), the LiteLLM_BudgetTable (spend caps), and any provider credentials stored in model_config metadata. Because LiteLLM frequently holds long-lived OpenAI, Anthropic, and Azure OpenAI keys on behalf of internal users, exploitation translates directly into multi-vendor credential theft, budget abuse, and the ability to pivot via manipulated DB rows (e.g., elevating a low-budget key into an admin role on the proxy itself). CISA's KEV addition on 2026-05-08 with a 3-day BOD 22-01 remediation deadline reflects observed in-the-wild exploitation of internet-exposed LiteLLM gateways.

Workaround: setting `disable_error_logs: true` under `general_settings` removes the error-handling path that allowed unauthenticated input to reach the vulnerable query. This is a mitigation only — the recommended action is to upgrade to LiteLLM 1.83.7-stable or later.

MITRE ATT&CK techniques used in TL-2026-0487

Initial Access

T1078 Valid Accounts; T1190 Exploit Public-Facing Application

Discovery

T1082 System Information Discovery; T1526 Cloud Service Discovery

Collection

T1119 Automated Collection; T1213 Data from Information Repositories

Credential Access

T1212 Exploitation for Credential Access; T1552 Unsecured Credentials; T1552.001 Unsecured Credentials: Credentials In Files; T1606 Forge Web Credentials

Impact

T1496 Resource Hijacking; T1565 Data Manipulation; T1565.001 Data Manipulation: Stored Data Manipulation

Lateral Movement

T1550.001 Use Alternate Authentication Material: Application Access Token

Exfiltration

T1567 Exfiltration Over Web Service

Reconnaissance

T1595 Active Scanning; T1595.002 Vulnerability Scanning; T1596 Search Open Technical Databases

defense-impairment

T1685 Disable or Modify Tools

Affected products and versions in BerriAI LiteLLM Pre-Auth SQL Injection in Proxy API Key

  • BerriAI — LiteLLM
    Vulnerable versions: >=1.81.16, <1.83.7
    Fixed in: 1.83.7-stable; 1.83.7
  • BerriAI — LiteLLM Proxy (PyPI: litellm)
    Vulnerable versions: >=1.81.16, <1.83.7
    Fixed in: 1.83.7
  • BerriAI — LiteLLM Proxy Docker Image (ghcr.io/berriai/litellm)
    Vulnerable versions: v1.81.16 through v1.83.6 stable and patch tags
    Fixed in: v1.83.7-stable and later

Remediation for BerriAI LiteLLM Pre-Auth SQL Injection in Proxy API Key

Patches

  • BerriAI LiteLLM 1.83.7-stable (https://github.com/BerriAI/litellm/releases/tag/v1.83.7-stable) — fix commit merged via PR #25467
  • Verify the patched Docker image with cosign: cosign verify --key https://raw.githubusercontent.com/BerriAI/litellm/0112e53046018d726492c814b3644b7d376029d0/cosign.pub ghcr.io/berriai/litellm:v1.83.7-stable

Immediate actions

  • Upgrade BerriAI LiteLLM to 1.83.7-stable or later on every proxy instance (Docker image: ghcr.io/berriai/litellm:v1.83.7-stable or newer)
  • If immediate upgrade is not possible, set disable_error_logs: true under general_settings in the LiteLLM proxy_config.yaml to break the unauthenticated path into the vulnerable query
  • Block public internet exposure of LiteLLM proxy admin and LLM API routes — place the proxy behind a VPN or zero-trust access gateway
  • Rotate every provider API key (OpenAI, Anthropic, Azure OpenAI, AWS Bedrock, Google Vertex, etc.) stored in or referenced by any LiteLLM proxy that ran a vulnerable version exposed to untrusted networks
  • Rotate every LiteLLM virtual key issued to internal teams or applications — assume the LiteLLM_VerificationToken table contents are compromised
  • Search proxy access logs for Authorization header anomalies: SQL meta-characters (single quote, double dash, semicolon, UNION), unusual header lengths, or repeated 5xx errors from /chat/completions and /embeddings

Workarounds

  • Set disable_error_logs: true under general_settings in proxy_config.yaml to remove the error-handling path through which unauthenticated input reached the vulnerable query
  • Restrict network exposure: bind LiteLLM only to an internal interface and front it with an authenticated reverse proxy until the upgrade is applied

Longer-term hardening

  • Deploy a WAF in front of LiteLLM that rejects Authorization headers containing SQL meta-characters or matching SQLi signatures
  • Move LiteLLM out of the public internet attack surface — front it with Cloudflare Access, Tailscale, or an internal API gateway that performs authentication before the proxy sees the request
  • Enable PostgreSQL audit logging (pgAudit) on the LiteLLM database and alert on UNION SELECT, information_schema queries, or pg_sleep usage
  • Adopt parameter-binding linters (e.g., bandit B608, semgrep python.lang.security.audit.formatted-sql-query) in CI for any internal proxy/gateway code
  • Treat AI gateway proxies as Tier-0 secrets infrastructure and apply the same controls used for password vaults: dedicated network segment, restricted egress, mandatory multi-factor admin auth, short-lived credentials

CVEs associated with BerriAI LiteLLM Pre-Auth SQL Injection in Proxy API Key

CVE-2026-42208

Weaknesses (CWE) in BerriAI LiteLLM Pre-Auth SQL Injection in Proxy API Key

CWE-89

Timeline of BerriAI LiteLLM Pre-Auth SQL Injection in Proxy API Key

  • BerriAI LiteLLM merges PR #25445 (fix(proxy): improve input validation on management endpoints) by jaydns — companion input-validation hardening landed one day before the SQLi patch.
  • BerriAI LiteLLM merges PR #25467 (fix(proxy): use parameterized query for combined_view token lookup) by jaydns — replaces f-string SQL interpolation with $1 placeholder and passes hashed_token as a bound parameter.
  • BerriAI publishes LiteLLM v1.83.7-stable on GitHub Releases (Docker image ghcr.io/berriai/litellm:v1.83.7-stable, signed with cosign).
  • GitHub Security Advisory GHSA-r75f-5x8p-qvmc and CVE-2026-42208 published. Advisory credits discovery to Tencent YunDing Security Lab and assigns CVSS v4.0 = 9.3 critical.
  • CISA required action under BOD 22-01: apply mitigations per vendor instructions, follow BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
  • CISA adds CVE-2026-42208 to the Known Exploited Vulnerabilities catalog citing evidence of active in-the-wild exploitation. NVD assigns CVSS v3.1 = 9.8.
  • BOD 22-01 remediation deadline for U.S. Federal Civilian Executive Branch (FCEB) agencies — three-day window indicating elevated operational urgency.
  • As of 2026-05-29, CVE-2026-42208 remains an active, CISA KEV-listed concern: a patch exists (LiteLLM 1.83.7+, now 1.83.10-stable) but it is still being exploited in the wild against 2,000+ internet-exposed proxies for LLM-provider credential theft. No successor supersedes it; unpatched gateways stay at live risk.

Sources cited for BerriAI LiteLLM Pre-Auth SQL Injection in Proxy API Key

Threats related to BerriAI LiteLLM Pre-Auth SQL Injection in Proxy API Key

Detection coverage for TL-2026-0487

As of 2026-05-08, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0487 across Splunk SPL, Microsoft KQL and Sigma, covering 13 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats