Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
🐍
🐍 PyPI
CISA KEV · ACTIVELY EXPLOITED
CRITICAL severity

LiteLLM has SQL Injection in Proxy API key verificationGHSA-r75f-5x8p-qvmc

CRITICAL

GHSA-r75f-5x8p-qvmc is a critical-severity (CVSS 9.8) SQL Injection vulnerability in litellm. It is in CISA's Known Exploited Vulnerabilities catalog (added 2026-05-08) — treat it as actively exploited and patch now. A fix is available for litellm — see the affected versions and patch details below.

Also known asCVE-2026-42208PYSEC-2026-391
Published
Updated
Affected
1 pkg
Patched
1 / 1
Exploits
None indexed
Exploitation data as of Oct 23, 2026 · OSV.dev, NVD, CISA KEV, FIRST.org (EPSS)

Exploitation Status

Actively exploited in the wild

  • Confirmed by CISA's Known Exploited Vulnerabilities catalog on 2026-05-08. Federal agencies were required to remediate by 2026-05-11.
  • CISA assesses this as automatable — exploitation doesn’t require manual, per-target effort, which raises the odds of mass scanning and opportunistic attacks.
  • A successful exploit gives an attacker total control of the affected component, not partial access.

Exploitation and automatability from CISA (KEV catalog and SSVC triage) for GHSA-r75f-5x8p-qvmc.

EPSS Exploitation Probability

via FIRST.org ↗
5.8%probability of exploitation in next 30 days
Lower Risk0.00%
Lower risk than most CVEs93th percentile — riskier than 93% of all scored CVEsHighest risk
0.00%33.3%66.7%100.0%54.3%89.4%89.4%5.8%5.8%Jun 26Sep 26Oct 26

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

GHSA-r75f-5x8p-qvmc by exploitation likelihood (EPSS) against impact (CVSS). Outside the shaded patch-first corner.

Where this sits among everything scored

Of 394,803 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Counts from FIRST.org, log-scaled.

Real-World Exposure

1 pkg affected
🐍litellm

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects PyPI packages — download data is not available via public APIs for these ecosystems.

Description

Impact

A database query used during proxy API key checks mixed the caller-supplied key value into the query text instead of passing it as a separate parameter. An unauthenticated attacker could send a specially crafted Authorization header to any LLM API route (for example POST /chat/completions) and reach this query through the proxy's error-handling path.

An attacker could read data from the proxy's database and may be able to modify it, leading to unauthorised access to the proxy and the credentials it manages.

Patches

Fixed in 1.83.7. The caller-supplied value is now always passed to the database as a separate parameter. Upgrade to 1.83.7 or later.

Workarounds

If upgrading is not immediately possible, set disable_error_logs: true under general_settings. This removes the path through which unauthenticated input reaches the vulnerable query.

References

Discovery Credit: Tencent YunDing Security Lab

Affected Packages

1 total 1 fixed
EcosystemPackageVulnerable rangeFix
🐍PyPIlitellm≥ 1.81.16&&< 1.83.71.83.7pip install --upgrade 'litellm==1.83.7'

Affected Products

1 product · 1 configurations
Application
litellmlitellm
≥ 1.81.16 && < 1.83.7
range

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for litellm, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update litellm to 1.83.7 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-r75f-5x8p-qvmc is resolved across your whole dependency graph.

  3. Workarounds

    Until you can upgrade, make sure every query built from user input uses parameterised statements or a prepared-statement API rather than string concatenation, and reduce the database account's privileges so an injected query cannot read or alter data beyond what the feature needs.

How to detect GHSA-r75f-5x8p-qvmc

A community-maintained Nuclei template exists for this CVE. You can scan for it directly:

nuclei -id ghsa-r75f-5x8p-qvmc -u https://target
Template
LiteLLM - SQL Injection
Severity
critical
Impact
Unauthenticated attackers can read and modify proxy database, leading to unauthorized access and credential compromise.
Remediation
Upgrade to version 1.83.7 or later.

Template by ProjectDiscovery nuclei-templates (HAERIN-L), MIT licensed. View the full template. Scan only systems you are authorised to test.

Frequently Asked Questions

### Impact A database query used during proxy API key checks mixed the caller-supplied key value into the query text instead of passing it as a separate parameter. An unauthenticated attacker could send a specially crafted `Authorization` header to any LLM API route (for example `POST /chat/completions`) and reach this query through the proxy's error-handling path. An attacker could read data from the proxy's database and may be able to modify it, leading to unauthorised access to the proxy and the credentials it manages. ### Patches Fixed in **`1.83.7`**. The caller-supplied value is now
O3 Security · Impact-Aware SCA

Is GHSA-r75f-5x8p-qvmc in your dependencies?

Find it across PyPI, including transitive dependencies.

Scan my dependencies How O3 SCA works
LiteLLM has SQL Injection in Proxy API key verification