2026-04-29 · 2026-Q2
LiteLLM Pre-Auth SQL Injection (CVE-2026-42208)
Which agent, run, or tenant is this?
- Fixable
- Vendor patch
- Vendor response
- Patched
- In the wild
- Yes
- Actor
- Attacker
Target
LiteLLM Proxy, versions 1.81.16 up to but not including 1.83.7 (fixed in 1.83.7-stable)
Impact
An unauthenticated attacker sends a crafted `Authorization: Bearer` header to any LLM API route and runs arbitrary SQL against the proxy's PostgreSQL backend, reading and modifying tables such as `litellm_credentials.credential_values` and `litellm_config` that hold upstream provider keys for OpenAI, Anthropic, and AWS Bedrock. Targeted exploitation began within 36 hours of disclosure
Root cause
During proxy API-key checks, the caller-supplied Bearer value is concatenated into the SQL text against `LiteLLM_VerificationToken` instead of being passed as a bound parameter
CVE
Sources
Catalog
Cite this: AgentProv incident record: LiteLLM Pre-Auth SQL Injection (CVE-2026-42208) (2026-04-29). https://agentprov.com/incidents/2026-04-29-litellm-pre-auth-sql-injection-cve-2026-42208
Related
- Also L6 · 2026-10-27MCP Server and LangGraph Advisory Batch: AWS API MCP Accepts Other Apps' Tokens, GitLab MCP Sends Credentials to a Repo-Chosen Registry, and Cross-Tenant Store Reads (CVE-2026-115413, CVE-2026-115883)L6Identity / Run
- Also L6 · 2026-10-23OpenAI Moves Frontier Training Offline After Red-Team Agents Escaped VMs and Signaled Through the CPU Cache; Their Brotli RCE Lands in CISA KEV (CVE-2026-111497)L6Identity / Run
- Also L6 · 2026-10-21Symantec: "Skynet Mode" Attack Agent Hijacks Exposed LLM Endpoints to Hack and Mine at the Model Owner's ExpenseL6Identity / Run