{
  "schema_version": "1.6.0",
  "id": "ACVE-2026-0403",
  "aliases": [
    "CVE-2026-42208"
  ],
  "modified": "2026-09-20T00:00:00Z",
  "summary": "LiteLLM proxy key check permits SQL injection authentication bypass",
  "details": "## What\n\nCVE-2026-42208 is the LiteLLM proxy SQL injection in the API-key check for versions 1.81.16 through before 1.83.7. A successful bypass changes the gateway authentication boundary around model and MCP operations. The record treats the KEV listing as exploitation evidence without inventing a victim total.\n\n## Which configuration is exposed\n\nA LiteLLM proxy in the affected version range is exposed when its API-key check protects a reachable gateway. The matcher uses the package/version signal available in the lock; it cannot determine whether the proxy was internet-facing or whether a key check was reached.\n\n## How ACVE detects it\n\nACVE scopes the package and version to one MCP server entry. Unknown resolution is possible and does not mean fixed. Network exposure and key rotation are operational checks outside static discovery.\n\n## Fix\n\nUpgrade to 1.83.7 or later, rotate master and downstream keys, and restrict the proxy to authenticated networks. Rebuild the lock so the resolved version reflects the deployed package, then audit MCP routes separately.\n\n## Grounding needed\n\nGrounding should confirm the KEV date and the package range. The public source does not provide a victim count or named actor.\n\nThis record is limited to the condition named in the public source: LiteLLM proxy key check permits SQL injection authentication bypass. A match is a review signal for that condition, not a claim that every installation, package, model, or host was compromised. Operators should preserve the resolved evidence and investigate adjacent credentials, network exposure, and execution history before closing the finding. The result should be retained with the lock snapshot used for the match so later review can distinguish configuration drift from a changed public record.",
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "litellm"
      },
      "ranges": [
        {
          "type": "SEMVER",
          "events": [
            {
              "introduced": "1.81.16"
            },
            {
              "fixed": "1.83.7"
            }
          ]
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "CRITICAL",
    "acve": {
      "specVersion": 1,
      "status": "candidate",
      "kind": "code",
      "vulnClasses": [
        "auth-bypass",
        "command-injection"
      ],
      "cwe": [
        "CWE-78"
      ],
      "exploitation": {
        "status": "exploited-itw",
        "checkedAt": "2026-09-20T00:00:00Z",
        "sources": [
          {
            "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42208",
            "type": "kev"
          }
        ],
        "kev": {
          "listed": true
        },
        "first_seen": "2026-05-08",
        "last_seen": "2026-05-08",
        "victims": {
          "range": "unverifiable",
          "sectors": [
            "technology"
          ],
          "evidence": "CISA KEV lists the CVE without a public victim count."
        },
        "attribution": "unattributed"
      },
      "cveBoundary": "cve-aliased",
      "matcher": {
        "some": "mcpServers",
        "where": {
          "all": [
            {
              "field": "package",
              "op": "eq",
              "value": "pkg:pypi/litellm"
            },
            {
              "field": "resolvedVersion",
              "op": "semverRange",
              "value": ">=1.81.16 <1.83.7"
            }
          ]
        }
      },
      "fix": {
        "summary": "Upgrade LiteLLM to 1.83.7 or later and rotate gateway keys.",
        "actions": [
          {
            "type": "upgrade",
            "target": "pypi:litellm",
            "to": "1.83.7",
            "why": "Use the fixed release."
          },
          {
            "type": "reconfigure",
            "target": "mcpServers.urlHost",
            "why": "Keep the proxy behind authentication."
          }
        ]
      },
      "grounding": {
        "itw": {
          "checkedAt": "2026-09-20T16:26:22Z",
          "sources": [
            {
              "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42208",
              "status": 200,
              "contentType": "text/html",
              "sha256": "sha256:a5a19f40b52361a2f1d8ed0ff9c6d73b29f7ee277bb51a1e9e8437d432d5cde7",
              "type": "kev"
            }
          ],
          "kev": {
            "listed": true
          }
        }
      }
    }
  }
}