SQL injection in LiteLLM, an LLM proxy (CVE-2026-42208) — the proxy's database and the credentials it manages are at risk
BerriAI LiteLLM, an open-source LLM proxy/gateway that unifies many LLM providers, has a SQL injection vulnerability. An attacker can read — and potentially modify — the proxy's database, leading to unauthorized access to the proxy and the credentials (API keys, etc.) it manages. CISA listed it as known-exploited (KEV) (CVSS 9.8 Critical).
Key facts
- CVE IDCVE-2026-42208
- CVSS base score9.8 CRITICAL
- CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Affected (vendor / product)BerriAI LiteLLM
- CWECWE-89
- ExploitationListed in CISA KEV (exploitation confirmed)
- Remediation due2026-05-11 (U.S. federal civilian agencies, BOD 22-01)
Key points
- SQL injection (CWE-89) in BerriAI LiteLLM (a popular OSS LLM proxy/gateway)
- An attacker can read/modify the proxy's DB, reaching the proxy and the credentials it manages
- An LLM proxy centrally manages many API keys/tokens = the "keyring" is exposed at once
- Listed in CISA KEV = exploitation confirmed (CVSS 9.8 Critical)
- Response: fix per vendor; rotate managed API keys/tokens on the assumption of leakage
- Of the 1,687 records held as of 2026-09-01, AI platform products total 8: Langflow 5, LiteLLM 2, MLflow 1.
1LiteLLM as an LLM proxy
CVE-2026-42208 is a SQL injection vulnerability (CWE-89) in BerriAI LiteLLM (a popular open-source LLM proxy/gateway that unifies access to many LLM providers behind a single interface). It was added to CISA's KEV catalog on May 8, 2026.
2Reading data from the proxy database
Per NVD, an attacker can exploit it to read data from the proxy's database and, in some cases, modify it. This is especially serious because an LLM proxy like LiteLLM holds the "keyring": it centrally manages connection details and API keys for many LLM providers (e.g. OpenAI and others), plus user tokens. If its database is compromised, the credentials for every LLM service reachable through the proxy can be exposed at once.
3AI infrastructure as a target
Like Langflow (CVE-2025-34291), this vulnerability targets AI infrastructure (the platform that runs and relays LLMs), showing that the software underpinning AI is being actively exploited.
4AI platform tools are starting to appear on KEV
Software supporting AI is being exploited in reality. Counting the AI platform products among the records this site holds gives the following.
What makes it severe is that an LLM proxy such as LiteLLM holds a bundle of keys. The proxy centrally manages connection details, API keys and user tokens for many LLM providers. Breach its database and the credentials for every LLM service reachable through it are exposed at once. Rotating the API keys and tokens it manages, on the assumption they leaked, is the safe course.
Why it matters
A case where compromising an LLM gateway can expose all the AI credentials it manages. Organizations running LLM proxies/gateways should, beyond patching, rotate API keys/tokens and review access logs — a prompt to revisit key management for AI infrastructure.
FAQ
What is LiteLLM?
Why are credentials at risk?
What should I do?
Sources (primary)
This article is an independent organization based on the U.S. official data below. Always verify the exact, latest details and applicability with the official and vendor sources.
- CISA KEV Catalog (known exploited list)
- NVD (CVE details / CVSS)
- Vendor / reference advisory
- This product uses data from the NVD API but is not endorsed or certified by the NVD. KEV data is CC0 (public domain).