LiteLLM Pre-Auth SQL Injection (CVE-2026-42208)

LiteLLM Proxy, versions 1.81.16 up to but not including 1.83.7 (fixed in 1.83.7-stable)

An unauthenticated attacker sends a crafted `Authorization: Bearer` header to any LLM API route and runs arbitrary SQL against the proxy's PostgreSQL backend, reading and modifying tables such as `litellm_credentials.credential_values` and `litellm_config` that hold upstream provider keys for OpenAI, Anthropic, and AWS Bedrock. Targeted exploitation began within 36 hours of disclosure

During proxy API-key checks, the caller-supplied Bearer value is concatenated into the SQL text against `LiteLLM_VerificationToken` instead of being passed as a bound parameter