ACVE-2026-0403

In the wild

exploited-itw · 2026-05-08 – 2026-05-08 · kev

Description

What

CVE-2026-42208 is the LiteLLM proxy SQL injection in the API-key check for versions 1.81.16 through before 1.83.7. A successful bypass changes the gateway authentication boundary around model and MCP operations. The record treats the KEV listing as exploitation evidence without inventing a victim total.

Which configuration is exposed

A LiteLLM proxy in the affected version range is exposed when its API-key check protects a reachable gateway. The matcher uses the package/version signal available in the lock; it cannot determine whether the proxy was internet-facing or whether a key check was reached.

How ACVE detects it

ACVE scopes the package and version to one MCP server entry. Unknown resolution is possible and does not mean fixed. Network exposure and key rotation are operational checks outside static discovery.

Fix

Upgrade to 1.83.7 or later, rotate master and downstream keys, and restrict the proxy to authenticated networks. Rebuild the lock so the resolved version reflects the deployed package, then audit MCP routes separately.

Grounding needed

Grounding should confirm the KEV date and the package range. The public source does not provide a victim count or named actor.

This record is limited to the condition named in the public source: LiteLLM proxy key check permits SQL injection authentication bypass. A match is a review signal for that condition, not a claim that every installation, package, model, or host was compromised. Operators should preserve the resolved evidence and investigate adjacent credentials, network exposure, and execution history before closing the finding. The result should be retained with the lock snapshot used for the match so later review can distinguish configuration drift from a changed public record.

Configuration

some mcpServers where
  and
    package eq "pkg:pypi/litellm"
    resolvedVersion semverRange ">=1.81.16 <1.83.7"

Fix

Upgrade LiteLLM to 1.83.7 or later and rotate gateway keys.

• Upgrade pypi:litellm to 1.83.7. Use the fixed release.
• Reconfigure mcpServers.urlHost. Keep the proxy behind authentication.

Validation

No validation entries recorded.

Grounding

No grounding checks recorded.

References

No references recorded.