BerriAI LiteLLM Unauthenticated SQL Injection in Proxy API Key Verification (CVE-2026-42208) — CVSS 9.8, CISA KEV

BerriAI LiteLLM Unauthenticated SQL Injection in Proxy API (TL-2026-0506), also tracked as GHSA-r75f-5x8p-qvmc, is a critical-severity software vulnerability scored CVSS 9.8, first published 2026-05-13. It has no confirmed attribution, affects BerriAI LiteLLM, references 1 CVE (CVE-2026-42208), maps to 27 MITRE ATT&CK techniques (T1005, T1041, T1048.003), and is covered by 9 detection rules and 23 indicators of compromise.

Key facts for TL-2026-0506

Threat ID
TL-2026-0506
Also known as
GHSA-r75f-5x8p-qvmc, LiteLLM Proxy SQLi, combined_view SQL Injection
Severity
CRITICAL
CVSS
9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-05-13
Last reviewed
2026-05-13
Attribution confidence
NONE
Motivation
FINANCIAL
Target sectors
technology, financial, healthcare, government, education, telecommunications, saas, ai-ml-startups, enterprise-it
Target regions
North America, Europe, Asia-Pacific, Global
Detection rules
9
Indicators of compromise
23

BerriAI LiteLLM AI Gateway versions 1.81.16 through 1.83.6 contain a critical pre-authentication SQL injection (CWE-89) in the proxy API key verification path. An unauthenticated attacker sends a crafted Authorization header to any LLM API route; the caller-supplied key is concatenated into the LiteLLM_VerificationTokenView (combined_view) lookup query via the proxy''s error-handling pathway, enabling arbitrary read and write against the proxy database that stores managed LLM provider credentials (OpenAI, Anthropic, Azure, Bedrock keys). CISA added the CVE to the Known Exploited Vulnerabilities catalog on 2026-05-08 with a federal due date of 2026-05-11; EPSS sits at 37.368% (97th percentile).

How BerriAI LiteLLM Unauthenticated SQL Injection in Proxy API works

BerriAI LiteLLM is a widely deployed open-source AI gateway / proxy (≈46,800 GitHub stars) used by enterprises to consolidate access to commercial LLM providers (OpenAI, Anthropic, Google, Azure, AWS Bedrock, Mistral, Cohere) behind a single API. The proxy authenticates callers with a virtual API key, persists per-key budgets, rate limits, model allow-lists, and stores provider credentials and PII in a Postgres database accessed via Prisma.

CVE-2026-42208 is a pre-authentication SQL injection in the proxy''s key verification routine. The vulnerability lives in the combined_view (LiteLLM_VerificationTokenView) lookup that resolves a caller-supplied API key into a verification token record. Between v1.81.16 and v1.83.6, a refactor introduced a code path where the raw caller-supplied key (extracted from the Authorization header) is interpolated directly into the SQL query string rather than passed as a Prisma query parameter. Under normal authentication the key is hashed before lookup, but the error-handling pathway (used for invalid-key telemetry/logging) re-runs a lookup that bypasses the hashing layer and concatenates the unsanitised key into the query text. Any HTTP route exposed by the proxy that requires authentication — POST /chat/completions, POST /v1/chat/completions, POST /embeddings, POST /v1/embeddings, POST /audio/transcriptions, POST /key/generate, GET /key/info, /moderations, /completions — reaches the vulnerable code path before authentication succeeds, making the bug fully unauthenticated and exploitable by any network-reachable attacker.

Exploitation chain: (1) attacker discovers an internet-reachable LiteLLM proxy (Shodan/Censys ''litellm'' banner, FastAPI /docs route, or Kubernetes ingress); (2) attacker sends POST /chat/completions with header ''Authorization: Bearer '' UNION SELECT ... -- '' and a minimal JSON body; (3) the proxy fails initial validation, enters the error-handling fall-through, executes the injected SQL against the Postgres backing store; (4) responses leak through error messages, timing oracles, or out-of-band channels (DNSlog, ngrok). With write access the attacker can insert their own LiteLLM_VerificationToken row granting unlimited budget and full model access, then pivot to abuse the stored upstream provider API keys (LiteLLM_Credentials, LiteLLM_ProxyModelTable, environment_variables column).

Downstream impact is severe because LiteLLM is positioned as the credential broker between developers and paid LLM providers. A successful exfiltration yields: live sk-... OpenAI keys, sk-ant-... Anthropic keys, Azure OpenAI endpoint+keys, AWS Bedrock IAM credentials embedded in the credentials table, and any virtual API keys issued to internal teams. Attackers can monetise stolen keys (compute resale on illicit LLM-as-a-service markets), use them for spam/phishing content generation, or pivot to the AWS/Azure tenant where Bedrock/OpenAI access has been granted.

The vendor (BerriAI) fixed the issue in PR #25467 by contributor jaydns (merged 2026-04-10) which replaced the unsafe combined_view raw query with a parameterized Prisma $queryRaw template literal, ensuring the caller-supplied token is bound as a separate parameter. v1.83.7-stable was released 2026-04-19 and the GHSA-r75f-5x8p-qvmc advisory was published 2026-04-20 crediting Tencent YunDing Security Lab. CISA added the CVE to KEV on 2026-05-08 following confirmed in-the-wild exploitation against U.S. federal civilian executive branch agencies and adjacent enterprise targets, with a hard federal remediation due date of 2026-05-11.

A temporary configuration workaround exists: setting general_settings.disable_error_logs: true in the proxy config removes the error-handling path that wraps the vulnerable lookup. This is not a substitute for the v1.83.7 upgrade as future code paths may reach the same query.

This vulnerability is part of a broader 2025-2026 trend of AI infrastructure (model proxies, RAG orchestrators, agent frameworks) inheriting classic web vulnerabilities (SQLi, SSRF, path traversal) because of rapid release cadence, raw-query usage, and a lack of established security review for the AI-tooling stack. Defenders should treat AI gateways as critical-tier credential vaults and apply the same scrutiny as IAM/secrets-management infrastructure.

MITRE ATT&CK techniques used in TL-2026-0506

Collection

T1005 Data from Local System; T1213 Data from Information Repositories

Exfiltration

T1041 Exfiltration Over C2 Channel; T1048.003 Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol

Execution

T1059 Command and Scripting Interpreter

Command and Control

T1071.001 Application Layer Protocol: Web Protocols

Defense Evasion

T1078 Valid Accounts

Initial Access

T1078.004 Valid Accounts: Cloud Accounts; T1190 Exploit Public-Facing Application

Discovery

T1082 System Information Discovery; T1526 Cloud Service Discovery

Persistence

T1098.001 Account Manipulation: Additional Cloud Credentials; T1136.003 Create Account: Cloud Account

Credential Access

T1212 Exploitation for Credential Access; T1528 Steal Application Access Token; T1552.001 Unsecured Credentials: Credentials In Files; T1552.005 Unsecured Credentials: Cloud Instance Metadata API

Impact

T1496 Resource Hijacking; T1565.001 Data Manipulation: Stored Data Manipulation

Lateral Movement

T1550.001 Use Alternate Authentication Material: Application Access Token

Resource Development

T1587.004 Develop Capabilities: Exploits; T1588.005 Obtain Capabilities: Exploits

Reconnaissance

T1593 Search Open Websites/Domains; T1595 Active Scanning; T1595.002 Vulnerability Scanning; T1596 Search Open Technical Databases

defense-impairment

T1685 Disable or Modify Tools

Affected products and versions in BerriAI LiteLLM Unauthenticated SQL Injection in Proxy API

  • BerriAI — LiteLLM
    Vulnerable versions: >=1.81.16, <1.83.7
    Fixed in: 1.83.7; 1.83.7-stable
  • BerriAI — litellm Python package (PyPI)
    Vulnerable versions: >=1.81.16, <1.83.7
    Fixed in: >=1.83.7
  • BerriAI — litellm Docker image (ghcr.io/berriai/litellm)
    Vulnerable versions: main-v1.81.16 through main-v1.83.6
    Fixed in: main-v1.83.7-stable

Remediation for BerriAI LiteLLM Unauthenticated SQL Injection in Proxy API

Patches

  • BerriAI/litellm v1.83.7-stable (pip / Docker image ghcr.io/berriai/litellm:main-v1.83.7-stable, released 2026-04-19)
  • Upstream commit / pull request: BerriAI/litellm#25467 (fix(proxy): use parameterized query for combined_view token lookup, merged 2026-04-10 by contributor jaydns)

Immediate actions

  • Upgrade BerriAI LiteLLM to v1.83.7-stable or later on every proxy instance (pip install --upgrade 'litellm[proxy]>=1.83.7' or pull the ghcr.io/berriai/litellm:main-v1.83.7-stable container).
  • If immediate upgrade is impossible, set general_settings.disable_error_logs: true in the proxy YAML and restart the proxy — this removes the error-handling path that wraps the vulnerable combined_view query.
  • Rotate every virtual API key stored in LiteLLM_VerificationToken (key/regenerate endpoint or wipe the table and reissue).
  • Rotate every upstream provider credential stored by the proxy (OpenAI, Anthropic, Azure OpenAI, AWS Bedrock, Google Vertex, Mistral, Cohere) — assume compromise.
  • Restrict network exposure: place the LiteLLM proxy behind authenticated ingress, mTLS, or VPN; do not expose /chat/completions, /v1/chat/completions, /embeddings, /key/* on the public internet.
  • Audit Postgres logs and the LiteLLM_VerificationToken / LiteLLM_SpendLogs / LiteLLM_Credentials tables for unexpected rows created between 2026-04-10 and the upgrade date.

Workarounds

  • Set general_settings.disable_error_logs: true in the LiteLLM proxy YAML configuration.
  • Front the proxy with an authenticated reverse proxy (NGINX auth_request, Cloudflare Access, Tailscale Funnel) that strips or validates the Authorization header before it reaches LiteLLM.
  • Block egress from the Postgres pod/instance backing LiteLLM to prevent OOB exfiltration in the event of a successful injection.

Longer-term hardening

  • Treat AI gateways as Tier-0 credential infrastructure equivalent to secrets managers; deploy them on isolated network segments with strict egress allow-listing.
  • Enforce least-privilege Postgres roles for LiteLLM — separate DDL/DML roles, prohibit superuser, restrict to schema-scoped permissions.
  • Deploy WAF rules in front of LiteLLM blocking Authorization headers containing SQL meta-characters (single quote, double-dash, UNION, SELECT, INFORMATION_SCHEMA).
  • Subscribe to the BerriAI/litellm GitHub security advisories feed and add LiteLLM to the SBOM-monitored components list.
  • Implement query-shape anomaly detection on the Postgres backing store (e.g., pg_audit or Datadog DBM) to alert on unexpected query templates against LiteLLM_VerificationTokenView.

CVEs associated with BerriAI LiteLLM Unauthenticated SQL Injection in Proxy API

CVE-2026-42208

Weaknesses (CWE) in BerriAI LiteLLM Unauthenticated SQL Injection in Proxy API

CWE-89

Timeline of BerriAI LiteLLM Unauthenticated SQL Injection in Proxy API

  • Tencent YunDing Security Lab reports SQL injection in LiteLLM proxy API key verification path to BerriAI maintainers via private security advisory.
  • BerriAI/litellm PR #25467 "fix(proxy): use parameterized query for combined_view token lookup" merged by contributor jaydns, replacing raw concatenated SQL with a Prisma $queryRaw parameterized template.
  • LiteLLM v1.83.7-stable released on PyPI and ghcr.io/berriai/litellm with the SQL injection fix and bundled hardening for MCP stdio transport and management endpoints.
  • GitHub Security Advisory GHSA-r75f-5x8p-qvmc published with CVE-2026-42208 assigned, crediting Tencent YunDing Security Lab; CVSS v3.1 9.8 / v4.0 9.3 documented.
  • GitHub Advisory Database ingests GHSA-r75f-5x8p-qvmc; advisory becomes discoverable via dependabot and pip-audit scanners.
  • CISA KEV entry assigns federal civilian executive branch (FCEB) agencies a remediation due date of 2026-05-11; private-sector defenders advised to treat as high-priority.
  • NVD publishes CVE-2026-42208 with full reference set and CVSS scoring; CISA simultaneously adds the CVE to the Known Exploited Vulnerabilities (KEV) catalog citing confirmed in-the-wild exploitation.
  • CISA-mandated federal remediation deadline reached; non-compliant FCEB agencies operating exposed LiteLLM instances enter BOD 22-01 violation status.
  • Threadlinqs Intelligence publishes threat record TL-2026-0506 with full MITRE mapping, detection coverage (Splunk SPL, Microsoft Sentinel KQL, Sigma), and attack simulation harness; correlation with BeaconBeagle C2 dataset performed.
  • As of 2026-05-29, CVE-2026-42208 (LiteLLM pre-auth SQLi) remains actively exploited and is a live CISA KEV entry; Sysdig confirmed targeted in-the-wild enumeration from Apr 26 with 2,000+ exposed instances. A fix shipped (v1.83.7, now v1.83.10-stable), but unpatched internet-facing proxies keep it a live credential-theft threat.

Sources cited for BerriAI LiteLLM Unauthenticated SQL Injection in Proxy API

Threats related to BerriAI LiteLLM Unauthenticated SQL Injection in Proxy API

Detection coverage for TL-2026-0506

As of 2026-05-13, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0506 across Splunk SPL, Microsoft KQL and Sigma, covering 23 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats