LiteLLM Proxy Authorization-Header SQL Injection — CISA KEV (CVE-2026-42208)
A critical, pre-authentication SQL injection flaw in the LiteLLM proxy lets anyone who can reach the server read or change its backend database — including stored provider API keys — by putting malicious SQL inside the Bearer token used for login. No valid credentials or admin access are needed.
How the attack works
LiteLLM checks API keys by inserting the caller's Bearer token directly into a SQL query against its verification table, without escaping it. This check happens before the proxy decides whether the caller is authenticated, so the injection works on any route, including normal chat/completion endpoints. An attacker sends a request with a single quote and extra SQL in the Authorization header — for example a tautology like `' OR 1=1 --` to bypass auth, a UNION clause to pull data out, `pg_sleep()` to confirm blind injection, or DROP/TRUNCATE to destroy data. Because the database stores upstream provider credentials in tables like litellm_credentials and litellm_config, a successful injection can expose or corrupt those keys.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- ce1c87e3-a839-46cf-9408-2f1838d3defc
- Severity
- Critical
- CVEs
- CVE-2026-42208
Why it matters
An attacker can bypass authentication entirely, steal or tamper with the proxy's configuration and stored upstream API keys, and potentially wipe database tables — all from an unauthenticated request to a public-facing endpoint.
What you can do
- →Upgrade LiteLLM proxy to a version outside the affected range (>=1.81.16, <1.83.7) immediately; this is listed in CISA's Known Exploited Vulnerabilities catalog with active exploitation.
- →Until patched, restrict network access to the proxy to trusted callers only and inspect Authorization headers for SQL metacharacters or keywords (quotes, UNION, OR 1=1, pg_sleep, DROP/TRUNCATE).
- →Rotate any upstream provider API keys stored in litellm_credentials/litellm_config if you cannot confirm the proxy was unaffected.
- →Review proxy and database logs for unusual query patterns or errors tied to Authorization header values, especially around the CVE's public disclosure date.
Known benign look-alikes
- Legitimate documentation or changelog text discussing CVE-2026-42208 patch notes.
- Static analysis tooling output documenting SQLi patterns for defensive purposes.
- CISA KEV catalog entries discussing CVE-2026-42208 for awareness.
- Patched LiteLLM proxy deployments that use parameterised query builders.