Is CVE-2026-42208 exploited in the wild?

Yes. CVE-2026-42208 is known to be exploited in the wild, first recorded on 8 May 2026. Treat it as urgent.

How severe is CVE-2026-42208?

Critical severity, with a CVSS score of 9.8, published 8 May 2026.

Which products and versions are affected?

Berriai LiteLLM >= 1.81.16, < 1.83.7, 1.81.16 to 1.83.6; litellm (PyPI) ECOSYSTEM:introduced=1.81.16,fixed=1.83.7.

Is there a fix for CVE-2026-42208?

Yes. litellm (PyPI): upgrade to 1.83.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-42208 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-42208?

Check whether you run Berriai LiteLLM or litellm (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-42208: BerriAI LiteLLM SQL injection in Proxy API key verification

Q: Is there a fix for CVE-2026-42208?

Yes. litellm (PyPI): upgrade to 1.83.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-42208 attacked?

It is attacked over the network, in a hosted service.

Q: Am I affected by CVE-2026-42208?

Check whether you run Berriai LiteLLM or litellm (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-42208 · Severity: critical · CVSS 9.8 · Exploited in the wild · Published 2026-05-08

LiteLLM is an AI gateway used to manage and proxy requests to various Large Language Model (LLM) providers. A security flaw allows unauthenticated attackers to bypass security checks and access the underlying database. This could result in the theft of sensitive API keys, modification of system data, or full unauthorized access to the proxy service and the AI credentials it manages.

Technologies: Berriai LiteLLM, litellm (PyPI). Vendors: Berriai, PyPI.

Quick answers

Is CVE-2026-42208 exploited in the wild?: Yes. CVE-2026-42208 is known to be exploited in the wild, first recorded on 8 May 2026. Treat it as urgent.
How severe is CVE-2026-42208?: Critical severity, with a CVSS score of 9.8, published 8 May 2026.
Which products and versions are affected?: Berriai LiteLLM >= 1.81.16, < 1.83.7, 1.81.16 to 1.83.6; litellm (PyPI) ECOSYSTEM:introduced=1.81.16,fixed=1.83.7.
Is there a fix for CVE-2026-42208?: Yes. litellm (PyPI): upgrade to 1.83.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-42208 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-42208?: Check whether you run Berriai LiteLLM or litellm (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

litellm (PyPI): upgrade to 1.83.7 or later
```
pip install "litellm>=1.83.7"
```

Technical details

A SQL injection vulnerability exists in LiteLLM's proxy API key verification mechanism. The application fails to properly parameterize database queries when checking API keys, instead concatenating caller-supplied values directly into the query string. An unauthenticated attacker can trigger this vulnerable path by sending a specially crafted Authorization header to any LLM API route (such as /chat/completions), which reaches the query via the proxy's error-handling logic. Successful exploitation allows for arbitrary data exfiltration or modification within the proxy's database, potentially leading to the compromise of all managed LLM credentials. The issue is fixed in version 1.83.7 by implementing parameterized queries.

Affected products

BerriAI LiteLLM >= 1.81.16, < 1.83.7

Identifiers

CVE-2026-42208
GHSA-r75f-5x8p-qvmc
PYSEC-2026-391

Timeline

2026-04-19: patched: Version 1.83.7-stable released
2026-04-20: advisory: GitHub Security Advisory GHSA-r75f-5x8p-qvmc published
2026-05-08: disclosed: CVE-2026-42208 published to NVD
2026-05-08: kev added: Added to CISA Known Exploited Vulnerabilities catalog

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.