LiteLLM Proxy SQL Injection (CVE-2026-42208, CISA KEV 2026-05-08) - ATR-2026-00529 (d6f0951f-459a-514c-8afa-2a88b0b6e11e)
Detects the SQL injection class exploited by CVE-2026-42208 in LiteLLM proxy (CVSS 9.3 per upstream advisory / 9.8 per Tenable; added to CISA KEV catalog 2026-05-08 with the standard BOD 22-01 3-day federal patch deadline). LiteLLM proxy admin/team management endpoints accept identifiers (team_id, user_id, model, key) that were interpolated into SQL queries without parameterization, allowing attackers to inject SQL via the API surface that the agent's own LLM proxy uses. The detection target is classic SQL injection metacharacter patterns appearing inside agent request payloads bound to LiteLLM-style endpoint paths.