CVE-2026-42208

Name of the Vulnerable Software and Affected Versions LiteLLM versions 1.81.16 through 1.83.6

Description LiteLLM, an AI Gateway proxy server for LLM APIs, contains a flaw where a database query used for API key checks incorporates caller-supplied values directly into the query text instead of using parameterized queries. An unauthenticated attacker can exploit this by sending a specially crafted Authorization header to any LLM API route, such as POST /chat/completions, reaching the vulnerable query via the proxy's error-handling path. This allows the attacker to read and potentially modify data within the proxy's database, specifically targeting tables like litellm credentials, LiteLLM VerificationToken, and litellm config to steal provider credentials and API keys. Real-world incidents show the issue was exploited within 36 hours of disclosure, with attackers using UNION SELECT payloads to extract sensitive information.

Recommendations Update LiteLLM to version 1.83.7 or later. As a temporary workaround, set disable error logs: true under general settings to remove the path that allows unauthenticated input to reach the vulnerable query. Revoke and regenerate all AI API keys (e.g., OpenAI, Anthropic, AWS Bedrock) stored in the proxy if the instance was exposed to the internet.