LiteLLM Proxy Authorization-Header SQL Injection — CISA KEV (CVE-2026-42208) - ATR-2026-00451 (2f4b8772-0116-58c9-a2e1-e901ef71ec9c)
Detects exploitation of CVE-2026-42208 (Critical, pre-auth SQL injection in the LiteLLM proxy). The injection surface is the Authorization: Bearer header value, NOT a URI/admin path: LiteLLM's API-key verification concatenates the caller-supplied Bearer token directly into a SELECT against the LiteLLM_VerificationToken table without parameter binding. Because the check runs before authentication is decided, any HTTP client that can reach the proxy can inject on any route (for example POST /chat/completions) — no admin endpoint or credentials required. A single quote escapes the string literal and appends arbitrary SQL, letting an attacker read or modify the backend Postgres (notably litellm_credentials / litellm_config, which hold upstream provider keys). Added to CISA's Known Exploited Vulnerabilities catalog on 2026-05-08; exploited in the wild within ~26 hours of advisory publication. Affected versions >= 1.81.16, < 1.83.7 (GHSA-r75f-5x8p-qvmc). This rule matches SQLi payload shapes (tautology auth bypass ' OR 1=1 --, UNION-based exfiltration, pg_sleep() blind, stacked DROP/TRUNCATE, metadata recon) carried inside an Authorization/Bearer token, and provides defence-in-depth post-patch by catching the payload shape regardless of upstream patch state. CWE-89.