Application securityCritical severity

SECURITY GUIDE

SQL Injection in BerriAI LiteLLM (CVE-2026-42208)

Review how unvalidated query parameters in LLM gateway telemetry endpoints permit unauthenticated schema enumeration and database exfiltration.

Areas to considerBerriAI LiteLLMAI GatewaysTelemetry & Logging Databases
01

THE CONTEXT

What to understand

CVE-2026-42208 is a critical SQL injection flaw affecting BerriAI LiteLLM proxy deployments from version 1.81.16 through 1.83.6. LiteLLM provides proxying and cost-tracking middleware across multiple AI providers. In the affected versions, spend-tracking and telemetry query handlers dynamically concatenated client-supplied request filters directly into database query strings instead of using parameterized queries. Unauthenticated remote clients could leverage this omission to inject arbitrary SQL statements.

02

HIGH-LEVEL CONCEPT

How the risk can develop

This is a conceptual overview, not a procedure for reproducing an attack.

  1. An unauthenticated client sends an HTTP request to an exposed LiteLLM metrics or spend-tracking route.
  2. Client-controlled filter parameters are passed into a database query builder without input sanitization or parameter binding.
  3. The database engine executes the concatenated query structure alongside unintended SQL control clauses.
  4. Query result sets or error messages expose schema structure, column counts, and database contents back to the caller.
03

WHY IT MATTERS

Potential impact

Unauthorized reading of API keys stored in gateway databases, schema discovery, data extraction from user prompt logs, and potential tampering with audit records.

04

BE AWARE

Signals to monitor

  • Database query logs showing syntax characters (quotes, semicolons, UNION SELECT) in proxy telemetry queries.
  • Elevated rates of database syntax or type mismatch errors originating from LiteLLM proxy containers.
  • Unusual outbound data transfer spikes from the analytics database service.
05

PUT DEFENSE FIRST

Recommended defenses

  1. 01Upgrade BerriAI LiteLLM to version 1.83.7 or newer where queries use parameterized statements.
  2. 02Deploy a web application firewall (WAF) rule to block common SQL injection patterns targeting gateway endpoints.
  3. 03Enforce least-privilege database user accounts, restricting proxy processes to only necessary read/write schemas.
  4. 04Rotate all upstream AI model API credentials stored in the proxy database.