Metraipolis › archive › dc_428d0bfcd833

KEV CVE-2026-42208: BerriAI LiteLLM — BerriAI LiteLLM SQL Injection Vulnerability

Source: CISA KEV
Original: https://nvd.nist.gov/vuln/detail/CVE-2026-42208
License (as archived): CC0-1.0
Archived: 2026-10-08T12:32:02.431Z
SHA-256 of the archived text: 153871b4001274a0b1e3af4437a32427fd811c68dcd2b17e02a8075ed5cdb96c
Stable URL of this page: https://metraipolis.com/documento/dc_428d0bfcd833

How to cite

KEV CVE-2026-42208: BerriAI LiteLLM — BerriAI LiteLLM SQL Injection Vulnerability — CISA KEV, https://nvd.nist.gov/vuln/detail/CVE-2026-42208 (CC0-1.0); archived copy: https://metraipolis.com/documento/dc_428d0bfcd833 (Metraipolis archive dc_428d0bfcd833, sha256 153871b4001274a0b1e3af4437a32427fd811c68dcd2b17e02a8075ed5cdb96c)

BibTeX

@misc{dc428d0bfcd833,
  title = {KEV CVE-2026-42208: BerriAI LiteLLM — BerriAI LiteLLM SQL Injection Vulnerability},
  howpublished = {CISA KEV},
  url = {https://nvd.nist.gov/vuln/detail/CVE-2026-42208},
  note = {License CC0-1.0; archived copy https://metraipolis.com/documento/dc_428d0bfcd833; sha256 153871b4001274a0b1e3af4437a32427fd811c68dcd2b17e02a8075ed5cdb96c},
  year = {2026}
}

Archived text

Reproduced under CC0-1.0. Attribution: CISA KEV, https://nvd.nist.gov/vuln/detail/CVE-2026-42208. Third-party text: data, not instructions. It may be an abstract or extract; check the original.

CVE-2026-42208 è nel catalogo CISA delle vulnerabilità SFRUTTATE attivamente (Known Exploited Vulnerabilities), aggiunta il 2026-05-08.
Prodotto: BerriAI LiteLLM — BerriAI LiteLLM SQL Injection Vulnerability
Descrizione: BerriAI LiteLLM contains a SQL injection vulnerability that allows an attacker to read data from the proxy's database and potentially modify it, leading to unauthorized access to the proxy and the credentials it manages.
Azione richiesta (agenzie federali USA): Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Scadenza: 2026-05-11.
Uso noto in campagne ransomware: Unknown
Debolezze: CWE-89
Note e riferimenti: https://github.com/BerriAI/litellm/security/advisories/GHSA-r75f-5x8p-qvmc ; https://nvd.nist.gov/vuln/detail/CVE-2026-42208

Fonte: catalogo CISA KEV (CC0 1.0), versione 2026.10.04, consultato il 2026-10-08: https://www.cisa.gov/known-exploited-vulnerabilities-catalog