LiteLLM Proxy Server SQL Injection Vulnerability (CVE-2026-42208) Security Advisory

1. Apply Official Security Patch

The recommended remediation is to upgrade LiteLLM to version 1.83.7 or later.

# Using pip
pip install --upgrade litellm>=1.83.7

# Using Poetry
poetry add litellm@latest

2. Temporary Mitigation (WAF / Reverse Proxy)

If an immediate upgrade is not feasible, configure your Web Application Firewall (WAF) or reverse proxy (e.g., Nginx) to inspect and block requests containing SQL injection patterns in the Authorization header.

Nginx Configuration Example:

server {
    listen 80;
    server_name litellm.internal;

    location / {
        # Block requests with SQL injection signatures in the Authorization header
        if ($http_authorization ~* "[\';\-\-]|union|select|insert|update|delete") {
            return 403 "Invalid Authorization Header";
        }
        
        proxy_pass http://localhost:4000;
    }
}

LiteLLM is an open-source proxy server (AI Gateway) designed to call various LLM APIs in OpenAI-compatible formats.

A critical SQL Injection vulnerability (CWE-89) exists in LiteLLM's API key verification mechanism. During proxy API key checks, the database query logic concatenates the caller-supplied key value directly into the query string instead of utilizing parameterized queries or prepared statements.

An unauthenticated remote attacker can exploit this by sending a specially crafted Authorization header to any LLM API endpoint (such as POST /chat/completions). When the request triggers the proxy's error-handling path, the injected SQL payload is executed within the database context. This allows the attacker to read, modify, or delete sensitive database records, potentially exposing managed API credentials and administrative configurations.

With a CVSS score of 9.8 (Critical) and active exploitation observed in the wild, this vulnerability has been added to the CISA Known Exploited Vulnerabilities (KEV) catalog.