CVE-2026-42208

The database query used during proxy API key verification directly embedded the key value supplied by the caller in the SQL query body, instead of passing it as a separate, parameterized parameter. An attacker could send a crafted Authorization header to any LLM API route (e.g., POST /chat/completions), and the malicious payload would reach the vulnerable query through the proxy error handling path. The lack of separation between input data and SQL code (CWE-89) allowed for manipulation of query logic and bypass of authentication (Auth Bypass).

An attacker can read the contents of the proxy database — including stored API keys and other credentials for LLM models — and potentially modify data, leading to unauthorized access to the gateway and all resources managed through it.

LiteLLM must be immediately updated to version 1.83.7 or later. The patch is available in the official GitHub repository: https://github.com/BerriAI/litellm/releases/tag/v1.83.7-stable

LiteLLM (BerriAI) in versions 1.81.16 to before 1.83.7

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

BerriAI LiteLLM contains a SQL injection vulnerability that allows an attacker to read data from the proxy's database and potentially modify it, leading to unauthorized access to the proxy and the credentials it manages.