PT-2026-35643 · Litellm · Litellm
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
LiteLLM versions 1.81.16 through 1.83.6
Description
An unauthenticated pre-auth SQL injection exists in the proxy API key verification process. The issue occurs because a database query mixes caller-supplied values directly into the query text instead of using parameterized queries. An attacker can exploit this by sending a specially crafted
Authorization header to any LLM API route, such as POST /chat/completions, reaching the vulnerable query via the proxy's error-handling path. This allows an attacker to read or modify data in the proxy's database, specifically targeting tables like litellm credentials, LiteLLM VerificationToken, and litellm config to steal provider credentials and API keys. The issue was exploited in the wild within 36 hours of disclosure, with attackers using UNION SELECT payloads to extract sensitive information.Recommendations
Update LiteLLM to version 1.83.7 or higher.
As a temporary workaround, set
disable error logs: true under general settings to remove the path that allows unauthenticated input to reach the vulnerable query.
Revoke and regenerate all OpenAI, Anthropic, and AWS Bedrock keys stored in the proxy if the instance was exposed to the internet.
Audit IAM logs for unauthorized model invocations or credential creation if AWS Bedrock was utilized.Exploit
Fix
RCE
LPE
SQL injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Litellm