CVE-2026-42208

CRITICALCVSS 9.8Known Exploited

CISA Known Exploited Vulnerability

https://github.com/BerriAI/litellm/security/advisories/GHSA-r75f-5x8p-qvmc ; https://nvd.nist.gov/vuln/detail/CVE-2026-42208

Remediation deadline: May 11, 2026

Description

BerriAI LiteLLM contains a SQL injection vulnerability that allows an attacker to read data from the proxy's database and potentially modify it, leading to unauthorized access to the proxy and the credentials it manages.

Timeline

Published:May 8th, 2026 4:16 AM

Last modified:July 15th, 2026 2:21 AM

Added to KEV:May 8th, 2026

CVSS Scoring

CVSS v3: 9.8 (CRITICAL)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Software

From NVD CPE configuration data

Vendors

litellm

Products

litellm

Weaknesses (CWE)

CWE-89

References & Reports

Advisories, patches, and third-party reports

https://github.com/BerriAI/litellm/releases/tag/v1.83.7-stableProduct
https://github.com/BerriAI/litellm/security/advisories/GHSA-r75f-5x8p-qvmcMitigation
https://access.redhat.com/security/cve/CVE-2026-42208Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2463965Mitigation
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42208.jsonThird Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-42208US Government Resource

Source: NIST NVD · Data may lag official sources by up to one minute