---
id: 3824
title: "CVE-2026-42208: Pre-Authentication SQL Injection in LiteLLM Proxy"
cve: CVE-2026-42208
cvss: 9.8
severity: critical
source_domain: bishopfox.com
source_url: "https://bishopfox.com/blog/cve-2026-42208-pre-authentication-sql-injection-in-litellm-proxy"
published_at: "2026-05-06 00:00"
tags: ["active-exploitation", "ai-security", "vulnerability-research", "sql-injection", "pre-auth", "litellm", "cve-2026-42208", "ai-gateway"]
phying_url: "https://phying.com/item/3824"
lang: en
---

# CVE-2026-42208: Pre-Authentication SQL Injection in LiteLLM Proxy

## Summary

CVE-2026-42208 is a pre-auth SQL injection in LiteLLM proxy 1.81.16–1.83.6: a missing bind lets attackers run SQL on any LLM route, confirmed via pg_sleep timing; exploitation hit ~36 hours later.

## Intelligence Metadata

- **Sources:** bishopfox.com
- **CVE:** CVE-2026-42208
- **CVSS:** 9.8
- **Published:** 2026-05-06 00:00
- **Original:** https://bishopfox.com/blog/cve-2026-42208-pre-authentication-sql-injection-in-litellm-proxy
- **Phying News:** https://phying.com/item/3824