CVE-2026-42208: critical SQL injection in LiteLLM, now on the CISA KEV catalog

CVE-2026-42208: critical SQL injection in LiteLLM, now on the CISA KEV catalog

In short

A critical SQL injection vulnerability (CVE-2026-42208, CVSS 9.3) has been confirmed in LiteLLM, a proxy widely used by companies to centralize and manage access to different AI models (OpenAI and compatible) [1]. The vulnerability is included in the CISA KEV catalog, which confirms it is already being actively exploited on the internet [2]. If your company uses LiteLLM as a gateway to AI services, today's priority is to check the installed version and update as soon as possible.

What it is and why it matters

LiteLLM acts as an intermediary between your applications and language model providers: it centralizes API keys, allows usage auditing, and makes it easier to switch providers without touching each application's code. Precisely because of this central position, a security flaw in it can compromise everything behind it: credentials, usage histories, and potentially business data passing through that proxy.

According to the official description of the vulnerability, between versions 1.81.16 and prior to 1.83.7, a database query used to verify the proxy's API keys mixed the value sent by the caller directly into the query text, instead of treating it as a separate parameter [1]. This opens the door to a classic SQL injection: an attacker, without needing to authenticate, can send a specially crafted authorization header to any API route (for example, the one used for chat requests) and reach that vulnerable query through the proxy's error handling [1]. The potential result is reading and possible modification of the proxy's database data, which can lead to unauthorized access to the system itself and to the credentials it manages [1].

This is a critical vulnerability ("critical" severity according to NVD, CVSS 9.3) [1], published on May 8, 2026 [1], and it already appears in CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating confirmed active exploitation, not just a theoretical risk [2].

Who is affected

It affects organizations that deploy LiteLLM as an AI proxy or gateway (AI Gateway) in versions ranging from 1.81.16 to prior to 1.83.7 [1]. The identified vendor is LiteLLM [1]. If your company has adopted generative AI tools through its own proxy layer managed by internal teams or external providers, it's worth checking whether LiteLLM is part of that architecture, either directly or as a component integrated into another solution.

How to know if you are vulnerable

• Identify whether LiteLLM is deployed in your infrastructure (on-premises, in the cloud, or as part of a third-party product) and exactly which version it runs.
• Check whether that version falls within the affected range (1.81.16 through prior to 1.83.7) [1].
• Check what surface of this proxy is exposed to the internet or accessible from poorly controlled networks: the more exposed an API route is, the greater the risk of it being reached by an exploitation attempt like the one described. At OCIRIA we recommend periodically reviewing which services and ports related to your AI infrastructure are visible from outside, something that often goes unnoticed when these tools are deployed quickly to speed up internal projects.
• Review the proxy logs for anomalous authorization headers or unusual error patterns on the API routes, which could indicate exploitation attempts.

How to protect yourself

1. Update LiteLLM to version 1.83.7 or later, where the flaw is fixed [1].

2. If you cannot update immediately, restrict access to the proxy's API to trusted networks and clients only while you apply the patch.

3. Rotate the credentials and keys managed by the proxy after updating, especially if there was internet exposure during the risk period.

4. Strengthen logging and monitoring of the proxy's API routes to detect past or future exploitation attempts.

5. Document the inventory of AI tools and their versions as part of routine vulnerability management, to react faster to the next similar advisory.

Frequently asked questions

Is this a serious vulnerability? Yes, it has critical severity with CVSS 9.3 according to NVD and is already listed as actively exploited in the CISA KEV catalog [1][2].

Do I need to be authenticated to be affected? No, according to the official description an unauthenticated attacker can attempt exploitation using a crafted header [1].

Is updating LiteLLM enough? It's the essential step, since version 1.83.7 fixes the flaw [1]; combine it with credential rotation and an exposure review to reduce residual risk.

How do I know if my company uses LiteLLM without knowing it? It's common for these components to be integrated within other AI solutions. Reviewing the technical inventory and the exposed surface is the most reliable way to find out.

Sources

• [1] https://nvd.nist.gov/vuln/detail/CVE-2026-42208
• [2] https://raw.githubusercontent.com/cisagov/kev-data/develop/known_exploited_vulnerabilities.json