LiteLLM存在SQL注入漏洞(CVE-2026-42208)

Description

PoC

None yet. Search at https://trap.biu.life/?ref=rss

References

• https://bishopfox.com/blog/cve-2026-42208-pre-authentication-sql-injection-in-litellm-proxy
• https://nvd.nist.gov/vuln/detail/CVE-2026-42208
• https://github.com/BerriAI/litellm/security/advisories/GHSA-r75f-5x8p-qvmc
• https://www.broadcom.com/support/security-center/protection-bulletin/cve-2026-42208-litellm-sql-injection-vulnerability-exploited-in-the-wild
• https://docs.litellm.ai/blog/cve-2026-42208-litellm-proxy-sql-injection
• https://www.sysdig.com/blog/cve-2026-42208-targeted-sql-injection-against-litellms-authentication-path-discovered-36-hours-following-vulnerability-disclosure
• https://thehackernews.com/2026/04/litellm-cve-2026-42208-sql-injection.html
• https://www.tenable.com/cve/CVE-2026-42208
• https://www.cve.org/CVERecord?id=CVE-2026-42208

Related Vulnerabilities

• PoCCVE-2026-40217: LiteLLM < 1.25.0 - Remote Code Execution
• PoClitellm-default-login: LiteLLM - Default Login
• PoCCVE-2026-30623: LiteLLM 1.18.10 - Command Injection
• PoCCVE-2026-42208: LiteLLM - SQL Injection
• PoCCVE-2026-42271: LiteLLM - Command Injection
• LiteLLM存在远程命令执行漏洞(CVE-2026-42271)
• LiteLLM /mcp-rest/test/connection 代码执行漏洞（CVE-2026-42271/CVE-2026-48710）
• PoClitellm-unauth-model-exposure: LiteLLM Proxy - Model Exposure
• PoCCVE-2026-35029: LiteLLM - Arbitrary File Read
• PoCLiteLLM /v1/chat/completions SQL 注入漏洞（CVE-2026-42208）
• PoCCVE-2024-6587: LiteLLM - Server-Side Request Forgery