CVE-2026-42208 is a SQL injection vulnerability in BerriAI LiteLLM. CISA added it to the Known Exploited Vulnerabilities catalogue on 8 May 2026, which means attackers have used it in real attacks. Organisations running the affected product should apply the vendor fix or mitigation as a priority.
What this vulnerability means for LiteLLM
SQL injection in an API-facing product means untrusted input can alter database queries instead of being treated as data. In a platform like BerriAI LiteLLM, that can expose configuration records, routing data, user metadata, or other backend information if the vulnerable query path is reached.
The danger is not limited to reading data. SQL injection can sometimes be used to modify records, bypass application logic, or pivot into broader compromise when the database account has excessive privileges. For a vulnerability that has already appeared in the CISA KEV catalogue, NIST National Vulnerability Database and the vendor advisory are the right places to confirm the exact affected scope and fix details.
Why this class of flaw is dangerous
SQL injection remains one of the most consequential web application weaknesses because it targets the boundary between application input and backend data access. If a request parameter, header, or API field reaches a query unsafely, an attacker may be able to extract data, tamper with records, or trigger database operations the application never intended to allow.
That matters even more in software that brokers access to other services, because a successful injection can expose secrets, session material, tenant data, or operational settings that were never meant to be directly reachable. The broader attack pattern is covered well in Web Application Attacks Guide and the OWASP Top 10, both of which place injection flaws among the core application security risks.
How organisations assess exposure and reduce impact
Exposure assessment starts with knowing where LiteLLM is deployed, which interfaces are reachable, and whether the vulnerable code path is actually in use. Organisations should check inventory, internet exposure, vendor advisories, and any internal forks or wrappers that may carry the same flaw into production.
If patching is delayed, compensate by reducing reachability and limiting what the backend database account can do. That means constraining network access, isolating the service, and tightening database privileges so an injected query cannot automatically become full database compromise. Guidance on scoping and prioritising remediation is well aligned with Vulnerability Management Guide, while Database Security Guide covers the database hardening side of the response.
Detection and post-exploitation review
Detection should focus on both exploit attempts and what may have happened after a successful injection. Web logs may show malformed parameters, unusual quoting, stacked query patterns, error-based probes, or repeated requests that target the same endpoint with changing payloads. Database logs may reveal unexpected reads, writes, or administrative actions.
After patching, review whether any data was accessed or altered, and whether the application stored credentials, API keys, or tokens in places reachable through the database. If the product stores sensitive material in backend tables, assume compromise of that store can have identity and access consequences beyond the application itself. For a practical incident lens on credential theft and downstream abuse, see The State of NHI & AI Agent Breach Report 2026.
Risk and Threat Considerations
Because this CVE is already in KEV, organisations should treat it as actively exploited rather than theoretical. The main risk is that an attacker who reaches the vulnerable query path can turn a normal application request into direct database access, which can expose stored data or enable deeper compromise if privileges are loose.
Failure mechanism: Unsafely concatenated input, dynamic query construction, or inadequate query parameterisation lets attacker-controlled text change the structure of a database statement.
Impact: Attackers may read, modify, or delete data, bypass application logic, or use the database foothold to support broader compromise and persistence.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 and OWASP ASVS set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | SA-11 — Developer Testing and Evaluation | SQL injection calls for secure testing and validation of application code paths. |
| SI-10 — Information Input Validation | The flaw exists because untrusted input can alter SQL statements. | |
| AU-6 — Audit Record Review, Analysis, and Reporting | Post-exploitation review depends on log analysis for exploit attempts and suspicious database activity. | |
| Recommendation — Test the vulnerable path for injection and verify the fix with security-focused code review. Enforce strict input validation and parameterized query handling on every database-bound input. Review application and database logs for injection probes and unauthorized query patterns. | ||
| OWASP ASVS | V4 — API and Web Service | The issue is an API-facing application flaw involving backend query handling. |
| V1 — Encoding and Sanitization | Injection is prevented by correctly handling untrusted input before it reaches SQL parsing. | |
| Recommendation — Verify API request handling and backend query construction against injection risks. Sanitize and encode untrusted input before it can influence query syntax. | ||
Practitioner Guidance
Why practitioners should care: For an exploited SQL injection, the remediation priority is not just “apply the patch”, but “verify exposure, contain blast radius, and confirm whether data access occurred.” That is especially important when the application sits in front of sensitive operational data or shared service credentials.
Practitioner takeaway: Treat the fix as a security event, not a maintenance task, and validate both the code path and the database permissions behind it.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 17, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org