# BerriAI LiteLLM Pre-Auth SQL Injection in Proxy API Key Verification — CVE-2026-42208 (CISA KEV, Active Exploitation)

> CISA added CVE-2026-42208 to the Known Exploited Vulnerabilities catalog on 2026-05-08 based on evidence of active exploitation. The flaw is an unauthenticated SQL injection (CWE-89) in BerriAI LiteLLM, an AI gateway proxy widely deployed to broker calls to OpenAI, Anthropic, Azure OpenAI, Bedrock, and other LLM providers. A token-lookup query against the LiteLLM_VerificationTokenView combined view interpolated the caller-supplied token into the SQL string with a Python f-string instead of a parameterized placeholder, and the proxy's error-handling path routed crafted Authorization headers through that query. An unauthenticated attacker can send a single HTTP request to any LLM API route (e.g., POST /chat/completions) and read or modify the proxy database — including all stored provider API keys, virtual key hashes, team and organization tables, and budget records.

- **Published:** 2026-05-08T12:00:00Z
- **Last reviewed:** 2026-05-08T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0487
- **ID:** TL-2026-0487
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 13 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-42208

## Description

BerriAI LiteLLM is an open-source AI gateway proxy that brokers requests across dozens of LLM providers (OpenAI, Anthropic, Azure OpenAI, AWS Bedrock, Google Vertex, Cohere, Mistral, etc.) using a single OpenAI-compatible API surface. The proxy authenticates inbound requests with virtual API keys whose hashed values are stored in a PostgreSQL table fronted by the LiteLLM_VerificationTokenView combined view. CVE-2026-42208 is a critical pre-authentication SQL injection in the proxy's token verification path.

Root cause: in litellm/proxy/utils.py around line 3016, the get_data() method built the verification query using an f-string — `WHERE v.token = ''{token}''` — and passed the resulting string to db.query_first() with no parameter binding. Although the proxy normally hashes the caller-supplied bearer token before lookup, the proxy's error-handling path could surface unhashed or partially-controlled input back into this query, allowing an attacker who sent a specially crafted Authorization header to inject arbitrary SQL. The fix (PR #25467, merged 2026-04-10) rewrites the query to use a parameterized placeholder — `WHERE v.token = $1` — and passes the hashed_token as a separate argument, eliminating the injection sink.

Exploitation: a single HTTP request to any LLM API route exposed by the proxy (POST /chat/completions, /embeddings, /v1/responses, /completions, /models, etc.) carrying a malicious Authorization: Bearer <payload> header is sufficient. No prior account, valid virtual key, network access, or user interaction is required. CVSS v3.1 = 9.8, CVSS v4.0 = 9.3. The discovery is credited to Tencent YunDing Security Lab; the maintainer fix was authored and merged by GitHub user jaydns.

Impact: LiteLLM proxies act as a single point of credential aggregation in modern AI stacks. A successful SQLi yields the entire LiteLLM_VerificationToken table (every virtual key issued to internal teams), the LiteLLM_TeamTable / LiteLLM_OrganizationTable / LiteLLM_ProjectTable rows (tenant boundaries), the LiteLLM_BudgetTable (spend caps), and any provider credentials stored in model_config metadata. Because LiteLLM frequently holds long-lived OpenAI, Anthropic, and Azure OpenAI keys on behalf of internal users, exploitation translates directly into multi-vendor credential theft, budget abuse, and the ability to pivot via manipulated DB rows (e.g., elevating a low-budget key into an admin role on the proxy itself). CISA's KEV addition on 2026-05-08 with a 3-day BOD 22-01 remediation deadline reflects observed in-the-wild exploitation of internet-exposed LiteLLM gateways.

Workaround: setting `disable_error_logs: true` under `general_settings` removes the error-handling path that allowed unauthenticated input to reach the vulnerable query. This is a mitigation only — the recommended action is to upgrade to LiteLLM 1.83.7-stable or later.

## MITRE ATT&CK

- T1595 Active Scanning
- T1595.002 Vulnerability Scanning
- T1596 Search Open Technical Databases
- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1552 Unsecured Credentials
- T1552.001 Unsecured Credentials: Credentials In Files
- T1212 Exploitation for Credential Access
- T1606 Forge Web Credentials
- T1082 System Information Discovery
- T1526 Cloud Service Discovery
- T1213 Data from Information Repositories
- T1119 Automated Collection
- T1685 Disable or Modify Tools
- T1550.001 Use Alternate Authentication Material: Application Access Token
- T1567 Exfiltration Over Web Service
- T1565 Data Manipulation
- T1565.001 Data Manipulation: Stored Data Manipulation
- T1496 Resource Hijacking

## Sources

- [CISA Alert: CISA Adds One Known Exploited Vulnerability to Catalog (2026-05-08)](https://www.cisa.gov/news-events/alerts/2026/05/08/cisa-adds-one-known-exploited-vulnerability-catalog)
- [CISA KEV Catalog Entry — CVE-2026-42208 (BerriAI LiteLLM SQL Injection Vulnerability)](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-42208)
- [NVD — CVE-2026-42208](https://nvd.nist.gov/vuln/detail/CVE-2026-42208)
- [GitHub Security Advisory GHSA-r75f-5x8p-qvmc — SQL injection in Proxy API key verification](https://github.com/BerriAI/litellm/security/advisories/GHSA-r75f-5x8p-qvmc)
- [BerriAI LiteLLM v1.83.7-stable Release Notes (patched build)](https://github.com/BerriAI/litellm/releases/tag/v1.83.7-stable)
- [BerriAI LiteLLM PR #25467 — fix(proxy): use parameterized query for combined_view token lookup](https://github.com/BerriAI/litellm/pull/25467)
- [BerriAI LiteLLM PR #25445 — fix(proxy): improve input validation on management endpoints (companion hardening)](https://github.com/BerriAI/litellm/pull/25445)
- [BerriAI LiteLLM Repository — proxy/utils.py (vulnerable file)](https://github.com/BerriAI/litellm/blob/v1.83.7-stable/litellm/proxy/utils.py)
- [Binding Operational Directive 22-01 — Reducing the Significant Risk of Known Exploited Vulnerabilities](https://www.cisa.gov/news-events/directives/binding-operational-directive-22-01)
- [MITRE ATT&CK — T1190 Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0487