FixVibe
Covered by FixVibecritical

LiteLLM Proxy SQL allura (CVE-2026-42208)

Muhimmiyar raunin allurar SQL (CVE-2026-42208) a cikin sashin wakili na LiteLLM yana bawa maharan damar ketare tantancewa ko samun damar bayanan bayanai masu mahimmanci ta hanyar amfani da tsarin tabbatarwa na maɓallin API.

CVE-2026-42208GHSA-r75f-5x8p-qvmcCWE-89

Tasiri

Siffofin LiteLLM 1.81.16 zuwa 1.83.7 sun ƙunshi mahimmancin raunin allura na SQL a cikin na'urar tantance mabuɗin API na wakili [S1]. Nasarar cin nasara yana bawa maharin da ba a tabbatar da shi damar ketare ikon tsaro ko aiwatar da ayyukan bayanai mara izini ba [S1]. An sanya wannan rauni a matsayin CVSS na 9.8, yana nuna babban tasirin sa akan sirrin tsarin da amincin [S2].

Tushen Dalili

Lalacewar ta wanzu saboda wakili na LiteLLM ya kasa yin tsafta da kyau ko daidaita maɓalli na API da aka bayar a cikin taken Authorization kafin amfani da shi a cikin tambayar bayanan [S1]. Wannan yana ba da izinin umarnin SQL masu ɓarna da aka saka a cikin taken don aiwatar da bayanan bayanan baya [S3].

Sigar da abin ya shafa

  • LiteLLM *: Siffofin 1.81.16 har zuwa (amma ba a haɗa su ba) 1.83.7 [S1].

Gyaran Kankare

Saukewa: ZXCVFIXVIBESEG10

  • Ɗaukaka LiteLLM *: Nan da nan haɓaka fakitin litellm zuwa sigar 1.83.7 ko kuma daga baya don daidaita kuskuren allura [S1].

Saukewa: ZXCVFIXVIBESEG11

  • Adit Database Logs: Bitar rajistan ayyukan shiga bayanai don ƙirar tambaya da ba a saba gani ba ko tsarin haɗin da ba a zata ba wanda ya samo asali daga sabis ɗin wakili [S1].

Saukewa: ZXCVFIXVIBESEG12

Dabarun Ganewa

Saukewa: ZXCVFIXVIBESEG13 Ƙungiyoyin tsaro na iya gano fallasa ta: Saukewa: ZXCVFIXVIBESEG14

  • Duban Sigar *: Yanayin dubawa yana bayyana nau'ikan LiteLLM a cikin kewayon da abin ya shafa (1.81.16 zuwa 1.83.6) [S1].

Saukewa: ZXCVFIXVIBESEG15

  • Kulawa da Shugaban *: Binciken buƙatun masu shigowa zuwa wakili na LiteLLM don ƙirar allurar SQL musamman a cikin filin alamar Authorization: Bearer [S1].