---
title: "LiteLLM SQLi (CVE-2026-42208)"
canonical: https://trickest.com/library/litellm-sql-injection-check-cve-2026-42208
description: "Point hosts at LiteLLM and flag CVE-2026-42208 (SQL injection) by version, then confirm with a sleep-only probe. Non-destructive. CISA KEV."
---

# LiteLLM SQLi (CVE-2026-42208)

## Overview

This workflow finds LiteLLM and sorts each host by whether its version falls in the CVE-2026-42208 range. LiteLLM is the proxy in front of model keys. CVE-2026-42208 is SQL injection that CISA listed on KEV. The check fingerprints the readiness endpoint and flags 1.81.16 through 1.83.6. Give it hostnames, IP addresses, or URLs you are authorised to test. The workflow fingerprints the product from the public page (title match on LiteLLM), reads the version from `/health/readiness` with a fallback to the root body, and compares that number to the range table in the graph. Every host comes back affected or not, so a fleet advisory becomes an evidenced list for [exposure management](/use-cases/exposure-management). CVE-2026-42208 is on CISA KEV (known exploited). Version flag is first. Hosts in range get a second node that only asks the chat-completions auth path to sleep. It does not dump rows or write data.

Run it on a schedule when the estate changes. New hosts and delayed patch windows are the reason the same check is worth more the second week than the first.

## Pipeline

1. Read the target list. Hosts, URLs, or ranges, one per line, become the scope.
2. Fingerprint each host as LiteLLM from the public page title, then GET `/health/readiness` and parse the version. A host counts as affected only when the fingerprint matches and the version is inside the encoded range.
3. Confirm only those flagged hosts with a time-based sleep on the chat-completions auth path.
4. Collect the per-host rows: product match, version, affected flag, confirmed flag, and any fetch error.
5. Emit the summary counts: hosts checked, product hits, affected, confirmed, and errors.

## Inputs

- **Target list.** Hostnames, IP addresses, CIDR ranges, or URLs, one per line. JSONL with a `url` field also works. Point it at scope you are authorised to test. Fingerprint is read-only GET. Confirm is a sleep-only probe, and only after the version flag.

## Outputs

- **results.jsonl.** One row per host: URL, whether LiteLLM was detected, the version read, the affected flag, and whether the sleep confirm succeeded.
- **summary.json.** Counts across the list: targets, product hits, affected, and errors.

## Integrations

- HTTP. Unauthenticated GET to the product root and `/health/readiness`. Confirm is a sleep-only probe on flagged hosts.

## Sample output

The records below are illustrative and do not come from a real run. They show one LiteLLM host inside the CVE-2026-42208 range, one patched host, and one host that is not the product.

```jsonl
{"target_url": "https://llm-a.example.com", "product_detected": true, "version": "1.83.6", "affected": true, "error": null}
{"target_url": "https://llm-b.example.org", "product_detected": true, "version": "1.83.7", "affected": false, "error": null}
{"target_url": "https://shop.example.net", "product_detected": false, "version": null, "affected": false, "error": "not_product"}
```

```json
{"cve": "CVE-2026-42208", "total_targets": 3, "affected": 1, "not_affected": 1, "errors": 1}
```

## FAQ

### Which LiteLLM versions does this flag?

1.81.16 through 1.83.6. 1.83.7 and later, and builds before 1.81.16 is the floor the graph treats as not affected. The compare uses the version the product itself served.

### Does a flagged host mean CVE-2026-42208 was exploited?

No. A flagged row is patch-lag against the range table. Confirm only asks the server to sleep. Treat a confirmed row as evidence the injection still answers, not as proof someone already used it.

### Is this check safe on production?

Yes. Fingerprint is read-only GET. Confirm is a sleep-only probe, only on hosts already in range. It does not dump rows, write data, or create accounts.

### Does the check need credentials?

No. It fingerprints the public page and reads `/health/readiness` the way an external scanner would.

### What is CVE-2026-42208?

SQL injection in LiteLLM. CISA listed it on KEV. The encoded range is 1.81.16 through 1.83.6. This workflow flags by version, then confirms with a sleep-only probe.

## Related workflows

- [Langflow RCE (CVE-2026-33017)](/library/langflow-code-injection-check-cve-2026-33017). Reach for it when the next LLM builder is Langflow.
- [Metabase SQLi (CVE-2026-72898)](/library/metabase-sql-injection-check-cve-2026-72898). Reach for it when the next SQLi flag is a BI server.
- [MCP Trust Boundary Suite](/library/mcp-trust-boundary-suite). Reach for it when you want MCP tool-trust evidence instead of a proxy version flag.

---
_Markdown source of https://trickest.com/library/litellm-sql-injection-check-cve-2026-42208._