BerriAI LiteLLM Unauthenticated SQL Injection in Proxy API Key Verification (CVE-2026-42208) — CVSS 9.8, CISA KEV — Threadlinqs Intelligence
As of 2026-05-30, BerriAI LiteLLM Unauthenticated SQL Injection in Proxy API Key Verification (CVE-2026-42208) — CVSS 9.8, CISA KEV is a critical-severity vulnerability threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 23 indicators of compromise.
Threat ID: TL-2026-0506 · Severity: CRITICAL · CVSS: 9.8 · Status: ACTIVE · Category: VULNERABILITY
BerriAI LiteLLM AI Gateway versions 1.81.16 through 1.83.6 contain a critical pre-authentication SQL injection (CWE-89) in the proxy API key verification path. An unauthenticated attacker sends a
BerriAI LiteLLM is a widely deployed open-source AI gateway / proxy (≈46,800 GitHub stars) used by enterprises to consolidate access to commercial LLM providers (OpenAI, Anthropic, Google, Azure, AWS Bedrock, Mistral, Cohere) behind a single API. The proxy authenticates callers with a virtual API key, persists per-key budgets, rate limits, model allow-lists, and stores provider credentials and PII in a Postgres database accessed via Prisma.
CVE-2026-42208 is a pre-authentication SQL injection in the proxy''s key verification routine. The vulnerability lives in the combined_view (LiteLLM_VerificationTokenView) lookup that resolves a caller-supplied API key into a verification token record. Between v1.81.16 and v1.83.6, a refactor introduced a code path where the raw caller-supplied key (extracted from the Authorization header) is interpolated directly into the SQL query string rather than passed as a Prisma query parameter. Under normal authentication the key is hashed before lookup, but the error-handling pathway (used for invalid-key telemetry/logging) re-runs a lookup that bypasses the hashing layer and concatenates the unsanitised key into the query text. Any HTTP route exposed by the proxy that requires authentication — POST /chat/completions, POST /v1/chat/completions, POST /embeddings, POST /v1/embeddings, POST /audio/transcriptions, POST /key/generate, GET /key/info, /moderations, /completions — reaches the vulnerable code path before authentication succeeds, making the bug fully unauthenticated and exploitable by any network-reachable attacker.
Exploitation chain: (1) attacker discovers an internet-reachable LiteLLM proxy (Shodan/Censys ''litellm'' banner, FastAPI /docs route, or Kubernetes ingress); (2) attacker sends POST /chat/completions with header ''Authorization: Bearer '' UNION SELECT ... -- '' and a minimal JSON body; (3) the proxy fails initial validation, enters the error-handling fall-through, executes the injected SQL against the Postgres backing store; (4) responses leak through error messages, timing oracles, or out-of-band channels (DNSlog, ngrok). With write access the attacker can insert their own LiteLLM_VerificationToken row granting unlimited budget and full model access, then pivot to abuse the stored upstream provider API keys (LiteLLM_Credentials, LiteLLM_ProxyModelTable, environment_variables column).
Downstream impact is severe because LiteLLM is positioned as the credential broker between developers and paid LLM providers. A successful exfiltration yields: live sk-... OpenAI keys, sk-ant-... Anthropic keys, Azure OpenAI endpoint+keys, AWS Bedrock IAM credentials embedded in the credentials table, and any virtual API keys issued to internal teams. Attackers can monetise stolen keys (compute resale on illicit LLM-as-a-service markets), use them for spam/phishing content generation, or pivot to the AWS/Azure tenant where Bedrock/OpenAI access has been granted.
The vendor (BerriAI) fixed the issue in PR #25467 by contributor jaydns (merged 2026-04-10) which replaced the unsafe combined_view raw query with a parameterized Prisma $queryRaw template literal, ensuring the caller-supplied token is bound as a separate parameter. v1.83.7-stable was released 2026-04-19 and the GHSA-r75f-5x8p-qvmc advisory was published 2026-04-20 crediting Tencent YunDing Security Lab. CISA added the CVE to KEV on 2026-05-08 following confirmed in-the-wild exploitation against U.S. federal civilian executive branch agencies and adjacent enterprise targets, with a hard federal remediation due date of 2026-05-11.
A temporary configuration workaround exists: setting general_settings.disable_error_logs: true in the proxy config removes the error-handling path that wraps the vulnerable lookup. This is not a substitute for the v1.83.7 upgrade as future code paths may reach the same query.
This vulnerability is part of a broader 2025-2026 trend of AI infrastructure (model proxies, RAG orchestrators, agent frameworks) inhe
Target sectors: technology, financial, healthcare, government, education, telecommunications, saas, ai-ml-startups, enterprise-it
Target regions: North America, Europe, Asia-Pacific, Global
Detections & IOCs
As of 2026-07-26, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 23 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, CRITICAL, threat intelligence, cybersecurity, CVE-2026-42208, T1595, T1595.002, T1596, T1593, T1587.004, T1588.005, T1190, T1078.004, T1059, T1098.001