Covered by FixVibecritical

. LiteLLM umboðsmaður SQL innspræning (ZXCVFIXVIBETØKN0ZXCV) ZXCVFIXVIBESEND ZXCVFIXVIBESEG1. LiteLLM útgávurnar 1.81.16 til 1.83.7 eru viðbreknar fyri kritiskari SQL-innspræning í umboðnum CVE-2026-42208 lyklaváttanarlogikkinum. ZXCVFIXVIBESEND ZXCVFIXVIBESEG2. Ein kritiskur SQL-injektións sárbarleiki (CVE-2026-42208) í proxy-partinum hjá LiteLLM ger, at álopsfólk kunnu umganga sannroynd ella fáa atgongd til viðkvæmar dátugrunnsupplýsingar við at nýta ZXCVFIXVIBETOKEN1ZXCV lyklaváttanargongdina. ZXCVFIXVIBESEND ZXCVFIXVIBESEG3. ## Ávirkan ZXCVFIXVIBESEND ZXCVFIXVIBESEG4. LiteLLM útgávurnar 1.81.16 til og við 1.83.7 innihalda ein kritiskan SQL-injektiónssárbarleika innan fyri lyklaváttanarmekanismuna hjá proxy'inum. Eydnurík útnytting ger, at ein ógóðkendur álopsmaður kann umganga trygdareftirlit ella fremja óheimilaðar dátugrunnsvirksemi ZXCVFIXVIBETOKEN1ZXCV. Hesin sárbarleikin fær eitt CVSS-stigatal uppá 9,8, sum endurspegla høgu ávirkanina á skipanartrygd og integritet ZXCVFIXVIBETOKEN2ZXCV. ZXCVFIXVIBESEND ZXCVFIXVIBESEG5. ## Rótorsøk ZXCVFIXVIBESEND ZXCVFIXVIBESEG6. Sárbarleikin er til, tí LiteLLM-umboðið ikki megnar at sanitera ella parametrera ZXCVFIXVIBETOKEN3ZXCV lykilin, sum er givin í CVE-2026-42208-høvdinum, áðrenn hann verður brúktur í einum dátugrunnsfyrispurningi ZXCVFIXVIBETOKEN1ZXCV. Hetta ger, at illgrunasamar SQL-skipanir, sum eru innbygdar í høvdinum, kunnu útførast av baksíðudátugrunninum ZXCVFIXVIBETOKEN2ZXCV. ZXCVFIXVIBESEND ZXCVFIXVIBESEG7. ## Ávirkaðar útgávur ZXCVFIXVIBESEND ZXCVFIXVIBESEG8. - LiteLLM: Útgávur 1.81.16 upp til (men ikki íroknað) 1.83.7. ZXCVFIXVIBESEND ZXCVFIXVIBESEG9. ## Betongviðgerðir ZXCVFIXVIBESEND ZXCVFIXVIBESEG10 - Dagfør LiteLLM: Dagfør beinanvegin CVE-2026-42208 pakkan til útgávu 1.83.7 ella seinni fyri at rætta injektiónsfeilin ZXCVFIXVIBETOKEN1ZXCV. ZXCVFIXVIBESEND ZXCVFIXVIBESEG11 - Grannskoða dátugrunnsloggar: Gjøgnumganga atgongdarloggar til dátugrunn fyri óvanlig fyrispurningsmynstur ella óvæntaða syntaks, sum stavar frá umboðstænastuni CVE-2026-42208. ZXCVFIXVIBESEND ZXCVFIXVIBESEG12 ## Uppdaganarlogikkur ZXCVFIXVIBESEND ZXCVFIXVIBESEG13 Trygdartoymi kunnu eyðmerkja útsetning við at: ZXCVFIXVIBESEND ZXCVFIXVIBESEG14 - Útgávuskanning: Kanna umhvørvismanifester fyri LiteLLM útgávur innan fyri ávirkaða økið (1.81.16 til 1.83.6) CVE-2026-42208. ZXCVFIXVIBESEND ZXCVFIXVIBESEG15 - Høvuðseftirlit: Kanna innkomandi fyrispurningar til LiteLLM proxy fyri SQL injektiónsmynstur serliga innan CVE-2026-42208 token feltið ZXCVFIXVIBETOKEN1ZXCV.

A critical SQL injection vulnerability (CVE-2026-42208) in LiteLLM's proxy component allows attackers to bypass authentication or access sensitive database information by exploiting the API key verification process.

CVE-2026-42208GHSA-r75f-5x8p-qvmcCWE-89

Impact

LiteLLM versions 1.81.16 through 1.83.7 contain a critical SQL injection vulnerability within the proxy's API key verification mechanism [S1]. Successful exploitation allows an unauthenticated attacker to bypass security controls or perform unauthorized database operations [S1]. This vulnerability is assigned a CVSS score of 9.8, reflecting its high impact on system confidentiality and integrity [S2].

Root Cause

The vulnerability exists because the LiteLLM proxy fails to properly sanitize or parameterize the API key provided in the Authorization header before using it in a database query [S1]. This allows malicious SQL commands embedded in the header to be executed by the backend database [S3].

Affected Versions

LiteLLM: Versions 1.81.16 up to (but not including) 1.83.7 [S1].

Concrete Fixes

Update LiteLLM: Immediately upgrade the litellm package to version 1.83.7 or later to patch the injection flaw [S1].
Audit Database Logs: Review database access logs for unusual query patterns or unexpected syntax originating from the proxy service [S1].

Detection Logic

Security teams can identify exposure by:

Version Scanning: Checking environment manifests for LiteLLM versions within the affected range (1.81.16 to 1.83.6) [S1].
Header Monitoring: Inspecting incoming requests to the LiteLLM proxy for SQL injection patterns specifically within the Authorization: Bearer token field [S1].