Free AI Safety Workshop — in collaboration with explainx.aiSave your seat
AgentbeamBeta
AI agent vulnerability · LiteLLM

CVE-2026-42208: LiteLLM has SQL Injection in Proxy API key verification

criticalCVSS 4.0 9.3 · 3.1 9.8ExploitedGHSA-r75f-5x8p-qvmc

Impact A database query used during proxy API key checks mixed the caller-supplied key value into the query text instead of passing it as a separate parameter. An unauthenticated attacker could send a specially crafted Authorization header to any LLM API route (for example POST /chat/completions) and reach this query through the proxy's error-handling path.

Published Apr 24, 2026 · Updated Oct 5, 2026

Affected packages

litellm

Ecosystem
PyPI
Affected
>= 1.81.16, < 1.83.7
Fixed in
1.83.7
Check
pip show litellm

Required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

Impact

A database query used during proxy API key checks mixed the caller-supplied key value into the query text instead of passing it as a separate parameter. An unauthenticated attacker could send a specially crafted Authorization header to any LLM API route (for example POST /chat/completions) and reach this query through the proxy's error-handling path.

An attacker could read data from the proxy's database and may be able to modify it, leading to unauthorised access to the proxy and the credentials it manages.

Patches

Fixed in `1.83.7`. The caller-supplied value is now always passed to the database as a separate parameter. Upgrade to 1.83.7 or later.

Workarounds

If upgrading is not immediately possible, set disable_error_logs: true under general_settings. This removes the path through which unauthenticated input reaches the vulnerable query.

References

Discovery Credit: Tencent YunDing Security Lab

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More LiteLLM vulnerabilities

All LiteLLM entries