This vulnerability is being actively exploited in the wild, according to the CISA Known Exploited Vulnerabilities catalog. CISA added it on May 8, 2026.

CriticalVulnerabilityLLM-specific

CVE-2026-42208: LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.81.16 to before…

Source: NVD(opens in a new tab)
Identifier: CVE-2026-42208
Published: May 8, 2026
Record updated: October 26, 2026

View JSON

Affected: litellm >= 1.81.16, < 1.83.7
Fixed in: 1.83.7
released April 13, 2026, 25 days before disclosure
Known exploitation: Listed in the CISA Known Exploited Vulnerabilities catalog since May 8, 2026.
EPSS: 89.4%

Summary

LiteLLM, a proxy server (AI Gateway) for calling LLM APIs, is affected by CVE-2026-42208 in versions 1.81.16 through before 1.83.7. During proxy API key checks, a database query mixed the caller-supplied key value into the query text instead of passing it as a separate parameter. An unauthenticated attacker can send a crafted Authorization header to any LLM API route, such as POST /chat/completions, and reach the query through the error-handling path, potentially reading or modifying proxy database data and gaining unauthorised access to managed credentials.

Mitigation

Fixed in 1.83.7.

Details

Scores and exploitation

Patch available: Yes
EPSS: 89.4%Estimated probability that this CVE is exploited in the next 30 days, from the FIRST Exploit Prediction Scoring System. Read on November 10, 2026.
Known exploitation: Listed in CISA KEV, exploited in the wild
Disclosure date: May 8, 2026

Weaknesses and techniques

Weakness (CWE): CWE-89
Attack pattern (CAPEC): CAPEC-66
AI threat technique (MITRE ATLAS): AML.T0010

Affected

Packages: litellm@>= 1.81.16, < 1.83.7 (fixed: 1.83.7)

Classification

Attack type: Supply chain,
Other
Attack sophistication: Trivial
AI component targeted: API
Impact: Confidentiality,
Integrity
Labels: security

How this record was produced

Summaries, mitigations and labels on this page are generated automatically from the source. The linked source is authoritative.

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-42208

First tracked: May 8, 2026 at 02:12 AM ET, from NVD/CVE Database

Classifier: claude-haiku-5-5, prompt v4

Classifier confidence: 95% (self-assessed)

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

litellmPyPILLM dependency since 2023-07-27 · 55 tracked dependents

Coverage

News, research and other items that mention CVE-2026-42208.

Exposed Infrastructure Reveals How Ransomware Affiliates Used AI Agents to Execute IntrusionsThe Hacker News · 2026-10-23

Summary

Mitigation

Affected packages in the Exposure Registry

Coverage

Related items