# BerriAI LiteLLM Unauthenticated SQL Injection in Proxy API Key Verification (CVE-2026-42208) — CVSS 9.8, CISA KEV

> BerriAI LiteLLM AI Gateway versions 1.81.16 through 1.83.6 contain a critical pre-authentication SQL injection (CWE-89) in the proxy API key verification path. An unauthenticated attacker sends a crafted Authorization header to any LLM API route; the caller-supplied key is concatenated into the LiteLLM_VerificationTokenView (combined_view) lookup query via the proxy''s error-handling pathway, enabling arbitrary read and write against the proxy database that stores managed LLM provider credentials (OpenAI, Anthropic, Azure, Bedrock keys). CISA added the CVE to the Known Exploited Vulnerabilities catalog on 2026-05-08 with a federal due date of 2026-05-11; EPSS sits at 37.368% (97th percentile).

- **Published:** 2026-05-13T12:00:00Z
- **Last reviewed:** 2026-05-13T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0506
- **ID:** TL-2026-0506
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 23 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-42208

## Description

BerriAI LiteLLM is a widely deployed open-source AI gateway / proxy (≈46,800 GitHub stars) used by enterprises to consolidate access to commercial LLM providers (OpenAI, Anthropic, Google, Azure, AWS Bedrock, Mistral, Cohere) behind a single API. The proxy authenticates callers with a virtual API key, persists per-key budgets, rate limits, model allow-lists, and stores provider credentials and PII in a Postgres database accessed via Prisma.

CVE-2026-42208 is a pre-authentication SQL injection in the proxy''s key verification routine. The vulnerability lives in the combined_view (LiteLLM_VerificationTokenView) lookup that resolves a caller-supplied API key into a verification token record. Between v1.81.16 and v1.83.6, a refactor introduced a code path where the raw caller-supplied key (extracted from the Authorization header) is interpolated directly into the SQL query string rather than passed as a Prisma query parameter. Under normal authentication the key is hashed before lookup, but the error-handling pathway (used for invalid-key telemetry/logging) re-runs a lookup that bypasses the hashing layer and concatenates the unsanitised key into the query text. Any HTTP route exposed by the proxy that requires authentication — POST /chat/completions, POST /v1/chat/completions, POST /embeddings, POST /v1/embeddings, POST /audio/transcriptions, POST /key/generate, GET /key/info, /moderations, /completions — reaches the vulnerable code path before authentication succeeds, making the bug fully unauthenticated and exploitable by any network-reachable attacker.

Exploitation chain: (1) attacker discovers an internet-reachable LiteLLM proxy (Shodan/Censys ''litellm'' banner, FastAPI /docs route, or Kubernetes ingress); (2) attacker sends POST /chat/completions with header ''Authorization: Bearer '' UNION SELECT ... -- '' and a minimal JSON body; (3) the proxy fails initial validation, enters the error-handling fall-through, executes the injected SQL against the Postgres backing store; (4) responses leak through error messages, timing oracles, or out-of-band channels (DNSlog, ngrok). With write access the attacker can insert their own LiteLLM_VerificationToken row granting unlimited budget and full model access, then pivot to abuse the stored upstream provider API keys (LiteLLM_Credentials, LiteLLM_ProxyModelTable, environment_variables column).

Downstream impact is severe because LiteLLM is positioned as the credential broker between developers and paid LLM providers. A successful exfiltration yields: live sk-... OpenAI keys, sk-ant-... Anthropic keys, Azure OpenAI endpoint+keys, AWS Bedrock IAM credentials embedded in the credentials table, and any virtual API keys issued to internal teams. Attackers can monetise stolen keys (compute resale on illicit LLM-as-a-service markets), use them for spam/phishing content generation, or pivot to the AWS/Azure tenant where Bedrock/OpenAI access has been granted.

The vendor (BerriAI) fixed the issue in PR #25467 by contributor jaydns (merged 2026-04-10) which replaced the unsafe combined_view raw query with a parameterized Prisma $queryRaw template literal, ensuring the caller-supplied token is bound as a separate parameter. v1.83.7-stable was released 2026-04-19 and the GHSA-r75f-5x8p-qvmc advisory was published 2026-04-20 crediting Tencent YunDing Security Lab. CISA added the CVE to KEV on 2026-05-08 following confirmed in-the-wild exploitation against U.S. federal civilian executive branch agencies and adjacent enterprise targets, with a hard federal remediation due date of 2026-05-11.

A temporary configuration workaround exists: setting general_settings.disable_error_logs: true in the proxy config removes the error-handling path that wraps the vulnerable lookup. This is not a substitute for the v1.83.7 upgrade as future code paths may reach the same query.

This vulnerability is part of a broader 2025-2026 trend of AI infrastructure (model proxies, RAG orchestrators, agent frameworks) inheriting classic web vulnerabilities (SQLi, SSRF, path traversal) because of rapid release cadence, raw-query usage, and a lack of established security review for the AI-tooling stack. Defenders should treat AI gateways as critical-tier credential vaults and apply the same scrutiny as IAM/secrets-management infrastructure.

## MITRE ATT&CK

- T1595 Active Scanning
- T1595.002 Vulnerability Scanning
- T1596 Search Open Technical Databases
- T1593 Search Open Websites/Domains
- T1587.004 Develop Capabilities: Exploits
- T1588.005 Obtain Capabilities: Exploits
- T1190 Exploit Public-Facing Application
- T1078.004 Valid Accounts: Cloud Accounts
- T1059 Command and Scripting Interpreter
- T1098.001 Account Manipulation: Additional Cloud Credentials
- T1136.003 Create Account: Cloud Account
- T1078 Valid Accounts
- T1685 Disable or Modify Tools
- T1212 Exploitation for Credential Access
- T1552.001 Unsecured Credentials: Credentials In Files
- T1552.005 Unsecured Credentials: Cloud Instance Metadata API
- T1528 Steal Application Access Token
- T1082 System Information Discovery
- T1526 Cloud Service Discovery
- T1550.001 Use Alternate Authentication Material: Application Access Token
- T1213 Data from Information Repositories
- T1005 Data from Local System
- T1071.001 Application Layer Protocol: Web Protocols
- T1041 Exfiltration Over C2 Channel
- T1048.003 Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol
- T1565.001 Data Manipulation: Stored Data Manipulation
- T1496 Resource Hijacking

## Sources

- [GHSA-r75f-5x8p-qvmc — SQL injection in LiteLLM Proxy API key verification](https://github.com/BerriAI/litellm/security/advisories/GHSA-r75f-5x8p-qvmc)
- [GitHub Advisory Database — GHSA-r75f-5x8p-qvmc](https://github.com/advisories/GHSA-r75f-5x8p-qvmc)
- [NVD — CVE-2026-42208](https://nvd.nist.gov/vuln/detail/CVE-2026-42208)
- [CISA KEV — BerriAI LiteLLM SQL Injection Vulnerability](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-42208)
- [LiteLLM v1.83.7-stable Release Notes](https://github.com/BerriAI/litellm/releases/tag/v1.83.7-stable)
- [BerriAI/litellm PR #25467 — fix(proxy): use parameterized query for combined_view token lookup](https://github.com/BerriAI/litellm/pull/25467)
- [LiteLLM Proxy Documentation — Authentication & API Keys](https://docs.litellm.ai/docs/proxy/virtual_keys)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0506