LiteLLM has SQL Injection in Proxy API key verification
Critical9.8CVE-2026-42208 · Published Apr 24, 2026 · updated Sep 10, 2026
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| litellm PyPI | >= 1.81.16, < 1.83.7 | 1.83.7 |
Details and references
### Impact A database query used during proxy API key checks mixed the caller-supplied key value into the query text instead of passing it as a separate parameter. An unauthenticated attacker could send a specially crafted `Authorization` header to any LLM API route (for example `POST /chat/completions`) and reach this query through the proxy's error-handling path. An attacker could read data from the proxy's database and may be able to modify it, leading to unauthorised access to the proxy and the credentials it manages. ### Patches Fixed in **`1.83.7`**. The caller-supplied value is now always passed to the database as a separate parameter. Upgrade to `1.83.7` or later. ### Workarounds If upgrading is not immediately possible, set `disable_error_logs: true` under `general_settings`. This removes the path through which unauthenticated input reaches the vulnerable query. ### References - Patched release: [`v1.83.7-stable`](https://github.com/BerriAI/litellm/releases/tag/v1.83.7-stable) **Discovery Credit**: Tencent YunDing Security Lab
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-89
- Also known as
- CVE-2026-42208, PYSEC-2026-391
More LiteLLM advisories
All LiteLLM| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Apr 24 | LiteLLM: Server-Side Template Injection in /prompts/test endpoint CVE-2026-42203Highfixed in 1.83.7 | High | 1.83.7 |
| Apr 25 | LiteLLM: Authenticated command execution via MCP stdio test endpoints CVE-2026-42271High8.8fixed in 1.83.7 | High8.8 | 1.83.7 |
| Apr 8 | LiteLLM: Password hash exposure and pass-the-hash authentication bypass GHSA-69x8-hrgq-fjj8Highfixed in 1.83.0 | High | 1.83.0 |
| May 11 | LiteLLM has a sandbox escape in custom-code guardrail CVE-2026-40217High8.8fixed in 1.83.10 | High8.8 | 1.83.10 |
| Apr 3 | LiteLLM: Authentication bypass via OIDC userinfo cache key collision CVE-2026-35030Criticalfixed in 1.83.0 | Critical | 1.83.0 |
| Apr 3 | LiteLLM: Privilege escalation via unrestricted proxy configuration endpoint CVE-2026-35029Highfixed in 1.83.0 | High | 1.83.0 |