LiteLLM Proxy Pre-Auth SQL Injection Scanner (CVE-2026-42208)

Authorization bearer interpolated into PostgreSQL token lookup — pre-auth blind SQLi on LiteLLM 1.81.16–1.83.6; fixed 1.83.7, CVSS 9.8.

Summary

CVE-2026-42208 is a critical unauthenticated SQL injection in BerriAI LiteLLM Proxy with CVSS 9.8. Rapid7's Metasploit module auxiliary/scanner/http/litellm_proxy_sqli scans for the flaw.

During API-key verification the proxy interpolates the raw Authorization bearer value into WHERE v.token = '<token>' without parameterization. Tokens not starting with sk- skip hashing and reach the query verbatim. The failure-path lookup is reachable before authentication.

Affected versions: 1.81.16 through 1.83.6 (fixed 1.83.7). Discovered by Tencent YunDing Security Lab.

Key Findings

Finding	Detail
CVE	CVE-2026-42208
Weakness	CWE-89 — SQL injection via Authorization header
Injection gate	Bearer values that do not start with `sk-` are not hashed
Scanner method	Benign PostgreSQL `pg_sleep` time-based differential (true vs false predicate)
False negative	Empty virtual-key table — `pg_sleep` never executes without matching rows
Default port	4000 (`/v1/chat/completions`)
Fixed version	1.83.7

Attack Chain

POST /v1/chat/completions + Authorization: Bearer ' OR pg_sleep(5)-- <random>
        ↓
LiteLLM interpolates bearer into token lookup query (unparameterized)
        ↓
PostgreSQL evaluates injected predicate → delayed response
        ↓
Attacker confirms SQLi → data exfiltration / further exploitation (module is detect-only)

Random suffix in bearer defeats in-memory auth cache — repeated tokens would skip the database lookup.

Impact

Internet-exposed LiteLLM proxy instances with provisioned API keys are vulnerable to full database compromise. Common in AI gateway deployments bridging multiple LLM providers.

Mitigation

Upgrade LiteLLM Proxy to 1.83.7+ immediately.
Do not expose the proxy admin/API surface to untrusted networks.
Monitor for Authorization headers containing SQL metacharacters (' OR, pg_sleep).

Related Signals

Exploitarium — Flowise MCP bypass
Exploit Arsenal collection — upstream also indexes CVE-2026-42208 PoC
Dalfox found-action RCE

Sources

→ Source