--- title: CVE-2026-42208: Pre-Authentication SQL Injection in... description: Bishop Fox researchers confirmed CVE-2026-42208, a critical pre-authentication SQL injection in BerriAI's LiteLLM proxy affecting versions 1.81.16 through... canonical: https://daily.dev/posts/cve-2026-42208-pre-authentication-sql-injection-in-litellm-proxy-rko5qky9l twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: CVE-2026-42208: Pre-Authentication SQL Injection in LiteLLM Proxy | daily.dev og:description: Bishop Fox researchers confirmed CVE-2026-42208, a critical pre-authentication SQL injection in BerriAI's LiteLLM proxy affecting versions 1.81.16 through... og:url: https://daily.dev/posts/cve-2026-42208-pre-authentication-sql-injection-in-litellm-proxy-rko5qky9l og:image: https://api.daily.dev/og/posts/RKO5QkY9L.png og:image:alt: CVE-2026-42208: Pre-Authentication SQL Injection in LiteLLM Proxy og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # CVE-2026-42208: Pre-Authentication SQL Injection in LiteLLM Proxy **[Sliver C2 Documentation](https://daily.dev/sources/bishopfox)** · 12 min read · 0 upvotes · 0 comments ## Summary Bishop Fox researchers confirmed CVE-2026-42208, a critical pre-authentication SQL injection in BerriAI's LiteLLM proxy affecting versions 1.81.16 through 1.83.6. The flaw lives in an internal helper (get_data() in proxy/utils.py) that interpolates an attacker-controlled bearer token directly into an f-string SQL query used to look up virtual keys against a PostgreSQL backend. Two separate code paths (an assertion-stripped path and an exception-handler failure path) reach the vulnerable sink without authentication. Although responses always return a generic 401, attackers can use PostgreSQL's pg_sleep() in a time-based blind injection to exfiltrate the entire LiteLLM_VerificationToken table, including virtual keys, team bindings, and budget caps. Exploitation in the wild was observed roughly 36 hours after the GitHub security advisory was published. The vendor patched the issue in version 1.83.7 by adding parameter binding to the vulnerable queries. Recommended actions include upgrading immediately, enabling disable_error_logs as an interim mitigation, adding a WAF rule to validate bearer token format, and rotating all virtual keys active during the vulnerable window. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is CVE-2026-42208 in LiteLLM proxy and which versions are affected? CVE-2026-42208 is a critical pre-authentication SQL injection in BerriAI's LiteLLM proxy, affecting versions 1.81.16 through 1.83.6. An internal helper function, get_data() in proxy/utils.py, interpolates an attacker-supplied bearer token directly into an f-string SQL query against the combined_view lookup used during authentication, letting unauthenticated attackers run arbitrary SQL against the PostgreSQL backend. It is fixed in version 1.83.7. _Teams running LiteLLM in production can track critical CVEs like this one on daily.dev before they hit their infrastructure._ ### How can I test if my LiteLLM proxy deployment is vulnerable to CVE-2026-42208? Send a single timed HTTP request to an LLM API route such as /v1/chat/completions with an Authorization header set to "Bearer ' OR (SELECT pg_sleep(6)) IS NULL --". A vulnerable host returns HTTP 401 in about six seconds due to the injected pg_sleep() call, while a patched host on 1.83.7 or later responds in under 100 milliseconds. Repeat the request to rule out network jitter or a WAF tarpit causing false positives. _Developers validating exposure to LLM gateway CVEs can follow write-ups like this one via daily.dev._ ### How did LiteLLM fix the f-string SQL injection vulnerability in version 1.83.7? LiteLLM 1.83.7 fixed the combined_view lookup by replacing the raw f-string interpolation with a positional PostgreSQL placeholder ($1), passing the hashed token as a separate parameter instead of embedding it in the query text. A sister deprecated-token lookup was extracted into a helper and rewritten using Prisma's typed find_first() API. The fix requires no schema migrations and only touches proxy/utils.py and key_management_endpoints.py. _Engineers patching AI gateway vulnerabilities can stay ahead of fixes like this one through daily.dev._ ## Similar posts on daily.dev - [Hackers are exploiting a critical LiteLLM pre-auth SQLi flaw](https://daily.dev/posts/hackers-are-exploiting-a-critical-litellm-pre-auth-sqli-flaw-zfoa4stcb) · BleepingComputer · 0 upvotes · 0 comments - [LiteLLM Vulnerability Chain: What Security Teams Running AI Gateways Need to Do Now](https://daily.dev/posts/litellm-vulnerability-chain-what-security-teams-running-ai-gateways-need-to-do-now-2dh1t9pl9) · Latest Hacking News · 0 upvotes · 0 comments - [What the LiteLLM Breach Teaches Us About Securing LLM Gateways](https://daily.dev/posts/what-the-litellm-breach-teaches-us-about-securing-llm-gateways-ysbbrmwzu) · Medium · 0 upvotes · 0 comments - [CVE-2026-59326: HTTP Proxy Credentials Logged in Plaintext by the Spring Boot Language Server](https://daily.dev/posts/cve-2026-59326-http-proxy-credentials-logged-in-plaintext-by-the-spring-boot-language-server-bjhmbawqm) · Spring · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#sql](https://daily.dev/tags/sql), [#postgresql](https://daily.dev/tags/postgresql), [#litellm](https://daily.dev/tags/litellm) [View this post on daily.dev](https://daily.dev/posts/cve-2026-42208-pre-authentication-sql-injection-in-litellm-proxy-rko5qky9l) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"CVE-2026-42208: Pre-Authentication SQL Injection in LiteLLM Proxy","url":"https://daily.dev/posts/cve-2026-42208-pre-authentication-sql-injection-in-litellm-proxy-rko5qky9l","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/cve-2026-42208-pre-authentication-sql-injection-in-litellm-proxy-rko5qky9l"},"datePublished":"2026-08-23T12:22:34.296Z","dateModified":"2026-08-23T12:47:09.770Z","description":"Bishop Fox researchers confirmed CVE-2026-42208, a critical pre-authentication SQL injection in BerriAI's LiteLLM proxy affecting versions 1.81.16 through...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/217cbf27e164e26df8cd59abb504eba4?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/217cbf27e164e26df8cd59abb504eba4?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Sliver C2 Documentation","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Sliver C2 Documentation","logo":"https://media.daily.dev/image/upload/logos/placeholder.jpg","url":"https://daily.dev/sources/bishopfox"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/cve-2026-42208-pre-authentication-sql-injection-in-litellm-proxy-rko5qky9l","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,sql,postgresql,litellm","timeRequired":"PT12M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Sliver C2 Documentation","item":"https://daily.dev/sources/bishopfox"},{"@type":"ListItem","position":3,"name":"CVE-2026-42208: Pre-Authentication SQL Injection in LiteLLM Proxy"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/cve-2026-42208-pre-authentication-sql-injection-in-litellm-proxy-rko5qky9l#faq","mainEntity":[{"@type":"Question","name":"What is CVE-2026-42208 in LiteLLM proxy and which versions are affected?","acceptedAnswer":{"@type":"Answer","text":"CVE-2026-42208 is a critical pre-authentication SQL injection in BerriAI's LiteLLM proxy, affecting versions 1.81.16 through 1.83.6. An internal helper function, get_data() in proxy/utils.py, interpolates an attacker-supplied bearer token directly into an f-string SQL query against the combined_view lookup used during authentication, letting unauthenticated attackers run arbitrary SQL against the PostgreSQL backend. It is fixed in version 1.83.7. Teams running LiteLLM in production can track critical CVEs like this one on daily.dev before they hit their infrastructure."}},{"@type":"Question","name":"How can I test if my LiteLLM proxy deployment is vulnerable to CVE-2026-42208?","acceptedAnswer":{"@type":"Answer","text":"Send a single timed HTTP request to an LLM API route such as /v1/chat/completions with an Authorization header set to \"Bearer ' OR (SELECT pg_sleep(6)) IS NULL --\". A vulnerable host returns HTTP 401 in about six seconds due to the injected pg_sleep() call, while a patched host on 1.83.7 or later responds in under 100 milliseconds. Repeat the request to rule out network jitter or a WAF tarpit causing false positives. Developers validating exposure to LLM gateway CVEs can follow write-ups like this one via daily.dev."}},{"@type":"Question","name":"How did LiteLLM fix the f-string SQL injection vulnerability in version 1.83.7?","acceptedAnswer":{"@type":"Answer","text":"LiteLLM 1.83.7 fixed the combined_view lookup by replacing the raw f-string interpolation with a positional PostgreSQL placeholder ($1), passing the hashed token as a separate parameter instead of embedding it in the query text. A sister deprecated-token lookup was extracted into a helper and rewritten using Prisma's typed find_first() API. The fix requires no schema migrations and only touches proxy/utils.py and key_management_endpoints.py. Engineers patching AI gateway vulnerabilities can stay ahead of fixes like this one through daily.dev."}}]} ```