LiteLLM Proxy Authorization-Header SQL Injection — CISA KEV (CVE-2026-42208)

Detects exploitation of CVE-2026-42208 (Critical, pre-auth SQL injection in the LiteLLM proxy). The injection surface is the `Authorization: Bearer` header value, NOT a URI/admin path: LiteLLM's API-key verification concatenates the caller-supplied Bearer token directly into a SELECT against the `LiteLLM_VerificationToken` table without parameter binding. Because the check runs before authentication is decided, any HTTP client that can reach the proxy can inject on any route (for example `POST /chat/completions`) — no admin endpoint or credentials required. A single quote escapes the string literal and appends arbitrary SQL, letting an attacker read or modify the backend Postgres (notably `litellm_credentials` / `litellm_config`, which hold upstream provider keys). Added to CISA's Known Exploited Vulnerabilities catalog on 2026-05-08; exploited in the wild within ~26 hours of advisory publication. Affected versions >= 1.81.16, < 1.83.7 (GHSA-r75f-5x8p-qvmc). This rule matches SQLi payload shapes (tautology auth bypass `' OR 1=1 --`, UNION-based exfiltration, `pg_sleep()` blind, stacked DROP/TRUNCATE, metadata recon) carried inside an `Authorization`/`Bearer` token, and provides defence-in-depth post-patch by catching the payload shape regardless of upstream patch state. CWE-89.

建議回應

參考資料

1. 01

   Authorization: Bearer token carrying classic tautology SQLi (1=1 / true / N=N) + SQL-comment terminator — CISA KEV CVE-2026-42208 canonical pre-auth exploit shape (injection is in the Bearer value, concatenated into the key-verification SELECT)

   欄位: content運算子: regex
2. 02

   Authorization: Bearer token with stacked destructive statement (DROP/TRUNCATE/DELETE TABLE) — CVE-2026-42208

   欄位: content運算子: regex
3. 03

   Authorization: Bearer token with UNION SELECT exfiltration probe against the LiteLLM Postgres backend — CVE-2026-42208

   欄位: content運算子: regex
4. 04

   Authorization: Bearer token with Postgres time-based blind primitive `pg_sleep(N)` — CVE-2026-42208 blind SQLi

   欄位: content運算子: regex
5. 05

   Bearer token referencing a LiteLLM backend table (LiteLLM_VerificationToken / litellm_credentials / litellm_config) in an injection context — direct CVE-2026-42208 exfil target

   欄位: content運算子: regex
6. 06

   Authorization: Bearer token probing Postgres metadata views (information_schema.tables, pg_user) — recon stage of CVE-2026-42208; requires concrete metadata identifiers

   欄位: content運算子: regex
7. 07

   Authorization: Bearer token with error-based / out-of-band SQLi primitives (extractvalue, updatexml, load_extension) — CVE-2026-42208

   欄位: content運算子: regex

攻擊範例（規則會觸發）

1. Authorization: Bearer sk-1234' OR 1=1 -- 

2. authorization: bearer x'; DROP TABLE LiteLLM_VerificationToken -- 

3. Authorization: Bearer foo' UNION ALL SELECT credential_values FROM litellm_credentials -- 

4. Authorization: Bearer x' AND pg_sleep(5)-- 

5. Bearer sk-abc' UNION SELECT k FROM litellm_config --

6. Authorization: Bearer 1' AND (SELECT 1 FROM information_schema.tables)-- 

7. Authorization: Bearer a' AND extractvalue(1,concat(0x7e,(SELECT version())))-- 

以上為真實攻擊 payload 的脫敏版本，與規則一同版本化，作為 regression test——確保未來的修訂不會悄悄漏掉它們。

正常樣本（規則不會觸發）

1. Patch changelog mentioning the CVE should not trigger

   LiteLLM 1.83.7 release notes: parameterised query replaces concat in the API-key verification path. Mitigates CVE-2026-42208 (CISA KEV).

2. Defensive awareness post describing the CVE should not trigger

   CISA added CVE-2026-42208 to the KEV catalog on 2026-05-08; the injection is in the Authorization Bearer header.

3. Benign Bearer token with no SQLi payload

   Authorization: Bearer sk-proj-abc123def456ghi789

4. Standard authenticated request with a normal Bearer token

   curl -H "Authorization: Bearer $LITELLM_KEY" -X POST /chat/completions

5. API documentation describing Bearer auth

   Use the Authorization header with a Bearer token to call any LiteLLM route.

6. Realistic JWT-style Bearer token with no injection content

   Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9

已知誤報情境

• ▸Legitimate documentation or changelog text discussing CVE-2026-42208 patch notes.
• ▸Static analysis tooling output documenting SQLi patterns for defensive purposes.
• ▸CISA KEV catalog entries discussing CVE-2026-42208 for awareness.
• ▸Patched LiteLLM proxy deployments that use parameterised query builders.

title: "LiteLLM Proxy Authorization-Header SQL Injection — CISA KEV (CVE-2026-42208)"
id: ATR-2026-00451
rule_version: 2
status: experimental
description: >
  Detects exploitation of CVE-2026-42208 (Critical, pre-auth SQL
  injection in the LiteLLM proxy). The injection surface is the
  `Authorization: Bearer` header value, NOT a URI/admin path: LiteLLM's
  API-key verification concatenates the caller-supplied Bearer token
  directly into a SELECT against the `LiteLLM_VerificationToken` table
  without parameter binding. Because the check runs before
  authentication is decided, any HTTP client that can reach the proxy
  can inject on any route (for example `POST /chat/completions`) — no
  admin endpoint or credentials required. A single quote escapes the
  string literal and appends arbitrary SQL, letting an attacker read or
  modify the backend Postgres (notably `litellm_credentials` /
  `litellm_config`, which hold upstream provider keys). Added to CISA's
  Known Exploited Vulnerabilities catalog on 2026-05-08; exploited in
  the wild within ~26 hours of advisory publication. Affected versions
  >= 1.81.16, < 1.83.7 (GHSA-r75f-5x8p-qvmc). This rule matches SQLi
  payload shapes (tautology auth bypass `' OR 1=1 --`, UNION-based
  exfiltration, `pg_sleep()` blind, stacked DROP/TRUNCATE, metadata
  recon) carried inside an `Authorization`/`Bearer` token, and provides
  defence-in-depth post-patch by catching the payload shape regardless
  of upstream patch state. CWE-89.
author: "ATR Community"
date: "2026/05/12"
schema_version: "0.1"
detection_tier: pattern
maturity: test
severity: critical

references:
  owasp_llm:
    - "LLM05:2025"
    - "LLM10:2025"
  owasp_agentic:
    - "ASI03:2026"
    - "ASI07:2026"
  mitre_atlas:
    - "AML.T0049 - Exploit Public-Facing Application"
    - "AML.T0024 - Exfiltration via AI Inference API"
  mitre_attack:
    - "T1190 - Exploit Public-Facing Application"
    - "T1059 - Command and Scripting Interpreter"
  cve:
    - "CVE-2026-42208"

metadata_provenance:
  mitre_atlas: human-reviewed
  mitre_attack: human-reviewed
  owasp_llm: human-reviewed
  owasp_agentic: human-reviewed
  cve: human-reviewed

compliance:
  eu_ai_act:
    - article: "15"
      context: "CVE-2026-42208 allows unauthenticated SQL execution against the LiteLLM proxy backend Postgres, exfiltrating provider API keys, model bindings, and user accounts; Article 15 cybersecurity requirements mandate parameterised queries in any AI control-plane component."
      strength: primary
    - article: "9"
      context: "Article 9 risk management must enumerate proxy admin-endpoint SQLi as a high-risk class — a single bypass exposes every downstream LLM provider key the proxy holds. CISA KEV listing confirms active in-the-wild exploitation."
      strength: primary
    - article: "14"
      context: "Article 14 (human oversight) requires high-risk AI systems to remain subject to effective human oversight; this rule provides detection evidence where the privilege-escalation attempt (LiteLLM Proxy Admin Endpoint SQL Injection — CISA KEV (CVE-2026-42208)) would bypass or undermine that oversight."
      strength: secondary
  nist_ai_rmf:
    - subcategory: "MP.5.1"
      context: "SQLi payloads targeting AI proxy admin endpoints must be tracked as a primary attack class against AI control-plane infrastructure; CISA KEV inclusion makes this a federally-prioritised remediation."
      strength: primary
    - subcategory: "MG.4.1"
      context: "Active exploitation against LiteLLM proxy admin endpoints requires immediate incident response; this rule generates the alert needed to initiate the MG.4.1 AI incident response process."
      strength: primary
    - subcategory: "MG.2.3"
      context: "Risk treatment plans under MG.2.3 must require parameterised queries on every admin endpoint of any AI proxy / gateway component."
      strength: primary
    - subcategory: "MS.2.7"
      context: "NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the privilege-escalation attempt (LiteLLM Proxy Admin Endpoint SQL Injection — CISA KEV (CVE-2026-42208))."
      strength: primary
  iso_42001:
    - clause: "8.1"
      context: "Operational controls under clause 8.1 must prohibit string concatenation of HTTP parameters into SQL queries in any AI control-plane component; parameterised query builders are mandatory."
      strength: primary
    - clause: "6.2"
      context: "ISO/IEC 42001 Clause 6.2 (AI objectives and planning) calls for risk treatment of known attack patterns; this rule's detection of the privilege-escalation attempt (LiteLLM Proxy Admin Endpoint SQL Injection — CISA KEV (CVE-2026-42208)) is such a treatment."
      strength: secondary

tags:
  category: privilege-escalation
  subcategory: auth-header-sqli-cve-kev
  scan_target: both
  confidence: high

agent_source:
  type: tool_call
  framework:
    - litellm
    - any
  provider:
    - any

detection:
  condition: any
  false_positives:
    - "Legitimate documentation or changelog text discussing CVE-2026-42208 patch notes."
    - "Static analysis tooling output documenting SQLi patterns for defensive purposes."
    - "CISA KEV catalog entries discussing CVE-2026-42208 for awareness."
    - "Patched LiteLLM proxy deployments that use parameterised query builders."
  conditions:
    - field: content
      operator: regex
      value: '(?i)\b(?:authorization:\s*)?bearer\s+[^\n"]{0,80}[\x27"]\s*(?:or|and)\s+(?:1\s*=+\s*1|true\b|\d+\s*=+\s*\d+)\s*(?:--(?=\s|$|["\x27\)])|/\*|#)'
      description: "Authorization: Bearer token carrying classic tautology SQLi (1=1 / true / N=N) + SQL-comment terminator — CISA KEV CVE-2026-42208 canonical pre-auth exploit shape (injection is in the Bearer value, concatenated into the key-verification SELECT)"

    - field: content
      operator: regex
      value: '(?i)\b(?:authorization:\s*)?bearer\s+[^\n"]{0,100}[\x27"]?\s*;\s*(?:drop|truncate|delete)\s+(?:table|from)\s+\w'
      description: "Authorization: Bearer token with stacked destructive statement (DROP/TRUNCATE/DELETE TABLE) — CVE-2026-42208"

    - field: content
      operator: regex
      value: '(?i)\b(?:authorization:\s*)?bearer\s+[^\n"]{0,120}\bunion\s+(?:all\s+)?select\s+'
      description: "Authorization: Bearer token with UNION SELECT exfiltration probe against the LiteLLM Postgres backend — CVE-2026-42208"

    - field: content
      operator: regex
      value: '(?i)\b(?:authorization:\s*)?bearer\s+[^\n"]{0,120}\bpg_sleep\s*\(\s*\d+\s*\)'
      description: "Authorization: Bearer token with Postgres time-based blind primitive `pg_sleep(N)` — CVE-2026-42208 blind SQLi"

    - field: content
      operator: regex
      value: '(?i)\bbearer\s+[^\n"]{0,120}\b(?:litellm_verificationtoken|litellm_credentials|litellm_config)\b[^\n]{0,40}(?:\bunion\b|\bselect\b|[\x27"]\s*(?:or|and)\b|;)'
      description: "Bearer token referencing a LiteLLM backend table (LiteLLM_VerificationToken / litellm_credentials / litellm_config) in an injection context — direct CVE-2026-42208 exfil target"

    - field: content
      operator: regex
      value: '(?i)\b(?:authorization:\s*)?bearer\s+[^\n"]{0,120}\b(?:information_schema\.tables|pg_catalog\.\w+|pg_user|pg_shadow)\b'
      description: "Authorization: Bearer token probing Postgres metadata views (information_schema.tables, pg_user) — recon stage of CVE-2026-42208; requires concrete metadata identifiers"

    - field: content
      operator: regex
      value: '(?i)\b(?:authorization:\s*)?bearer\s+[^\n"]{0,120}\b(?:extractvalue|updatexml|load_extension)\s*\('
      description: "Authorization: Bearer token with error-based / out-of-band SQLi primitives (extractvalue, updatexml, load_extension) — CVE-2026-42208"

response:
  actions:
    - block_input
    - alert
    - escalate
    - snapshot
  notify:
    - security_team

remediation: >
  Upgrade LiteLLM proxy to >= 1.83.7 immediately — CISA KEV listing
  means active exploitation is occurring in the wild (first hit
  observed ~26 hours after advisory publication). Rotate every
  upstream provider API key and credential the proxy database has held
  since deployment — the injection targets `litellm_credentials` /
  `litellm_config`, so assume provider keys are compromised. Audit
  Postgres logs for queries against `LiteLLM_VerificationToken`,
  `litellm_credentials`, and `litellm_config` originating from the
  proxy service account. The fix replaces string-concatenated SQL in
  the API-key verification path with parameterised queries. If a patch
  window is unavailable, place the proxy behind a reverse proxy that
  rejects any `Authorization` header value containing a single quote,
  parenthesis, or SQL keyword (UNION, SELECT, OR, --).

test_cases:
  true_positives:
    - input: "Authorization: Bearer sk-1234' OR 1=1 -- "
      expected: triggered
      description: "Canonical tautology SQLi in the Bearer token — CISA KEV CVE-2026-42208 pre-auth exploit shape"
    - input: "authorization: bearer x'; DROP TABLE LiteLLM_VerificationToken -- "
      expected: triggered
      description: "Stacked DROP TABLE injected via the Bearer value"
    - input: "Authorization: Bearer foo' UNION ALL SELECT credential_values FROM litellm_credentials -- "
      expected: triggered
      description: "UNION-based exfil of litellm_credentials via the Bearer header"
    - input: "Authorization: Bearer x' AND pg_sleep(5)-- "
      expected: triggered
      description: "Time-based blind SQLi via pg_sleep in the Bearer token"
    - input: "Bearer sk-abc' UNION SELECT k FROM litellm_config --"
      expected: triggered
      description: "Bearer value referencing a LiteLLM backend table in a UNION exfil"
    - input: "Authorization: Bearer 1' AND (SELECT 1 FROM information_schema.tables)-- "
      expected: triggered
      description: "Recon stage probing Postgres metadata via the Bearer header"
    - input: "Authorization: Bearer a' AND extractvalue(1,concat(0x7e,(SELECT version())))-- "
      expected: triggered
      description: "Error-based SQLi using extractvalue in the Bearer token"
  true_negatives:
    - input: "LiteLLM 1.83.7 release notes: parameterised query replaces concat in the API-key verification path. Mitigates CVE-2026-42208 (CISA KEV)."
      expected: not_triggered
      description: "Patch changelog mentioning the CVE should not trigger"
    - input: "CISA added CVE-2026-42208 to the KEV catalog on 2026-05-08; the injection is in the Authorization Bearer header."
      expected: not_triggered
      description: "Defensive awareness post describing the CVE should not trigger"
    - input: "Authorization: Bearer sk-proj-abc123def456ghi789"
      expected: not_triggered
      description: "Benign Bearer token with no SQLi payload"
    - input: 'curl -H "Authorization: Bearer $LITELLM_KEY" -X POST /chat/completions'
      expected: not_triggered
      description: "Standard authenticated request with a normal Bearer token"
    - input: "Use the Authorization header with a Bearer token to call any LiteLLM route."
      expected: not_triggered
      description: "API documentation describing Bearer auth"
    - input: 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9'
      expected: not_triggered
      description: "Realistic JWT-style Bearer token with no injection content"