LiteLLM, a proxy server for LLM APIs, versions >=1.81.16 and <1.83.7 contain an SQL injection vulnerability (CWE-89) due to improper neutralization of special elements in SQL commands. Specifically, the database query used for API key validation concatenates the caller-supplied key directly into the query string instead of using parameterized queries. This flaw allows unauthenticated attackers to exploit the proxy's error-handling path by sending specially crafted Authorization headers to any LLM API endpoint, such as POST /chat/completions. Successful exploitation can lead to unauthorized reading and modification of the proxy's database, compromising access controls and credentials. The vulnerability is fixed in version 1.83.7. The CVSS 4.0 base score is 9.3 (critical), reflecting network attack vector, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. The vendor advisory from Red Hat confirms the vulnerability and the patch availability.

An unauthenticated attacker can exploit this SQL injection vulnerability to read and potentially modify the proxy's database. This can lead to unauthorized access to the proxy server and the credentials it manages, compromising the security of the system and any dependent services. The impact affects confidentiality, integrity, and availability of the proxy and its data.

A patch is available in LiteLLM version 1.83.7 that fixes this SQL injection vulnerability by properly parameterizing the database queries. Users should upgrade affected installations to version 1.83.7 or later. There is no indication from the vendor advisory that any other mitigation or temporary workaround is required.