https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Sat, 04 Jul 2026 00:23:19 +0000 https://vulnerability.circl.lu/sighting/7f19ba20-f805-4d9b-a668-d3e1891fa978/export {"uuid": "7f19ba20-f805-4d9b-a668-d3e1891fa978", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42208", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mph2eyvwy423", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-42208 \u0432 LiteLLM: \u0443\u0433\u0440\u043e\u0437\u044b \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/CB129B39-564F-412A-99C2-3B2117245CBC", "creation_timestamp": "2026-06-29T17:49:54.220413Z"} {"uuid": "7f19ba20-f805-4d9b-a668-d3e1891fa978", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42208", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mph2eyvwy423", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-42208 \u0432 LiteLLM: \u0443\u0433\u0440\u043e\u0437\u044b \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/CB129B39-564F-412A-99C2-3B2117245CBC", "creation_timestamp": "2026-06-29T17:49:54.220413Z"} https://vulnerability.circl.lu/sighting/7f19ba20-f805-4d9b-a668-d3e1891fa978/export Mon, 29 Jun 2026 17:49:54 +0000 https://vulnerability.circl.lu/sighting/8e78cef2-363e-4dc3-994e-8b872f5d9c95/export {"uuid": "8e78cef2-363e-4dc3-994e-8b872f5d9c95", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42208", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/litellm_proxy_sqli.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"\", \"author\": [\"Tencent YunDing Security Lab\", \"Kenneth LaCroix\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module detects BerriAI LiteLLM proxy servers affected by\\n CVE-2026-42208, an unauthenticated SQL injection. During API-key\\n verification the proxy interpolates the raw Authorization bearer value\\n into a PostgreSQL query (WHERE v.token = '') without\\n parameterization. Because LiteLLM only hashes tokens that begin with\\n \\\"sk-\\\", a bearer value that does not start with \\\"sk-\\\" reaches the query\\n verbatim and is injectable. The failure path that performs the lookup is\\n reachable before authentication. Affected versions are 1.81.16 through\\n 1.83.6 (fixed in 1.83.7).\\n\\n The module confirms the flaw with a benign time-based check built on the\\n framework's PostgreSQL time-based blind SQL injection library. It issues a\\n request whose injected predicate sleeps only when a tautology is true and a\\n second request whose predicate never sleeps, and reports the target\\n vulnerable only when the first is delayed while the second returns promptly.\\n A server that is merely slow delays both requests and is not flagged. The\\n module does not read or exfiltrate data.\\n\\n Detection requires the target to have provisioned at least one virtual\\n key. The injectable predicate sits in a WHERE clause that PostgreSQL\\n evaluates only against matching rows, so when the token table is empty\\n the pg_sleep never executes and the proxy appears (falsely) safe. Any\\n LiteLLM proxy in real use has issued keys; a freshly initialized proxy\\n with an empty token table may not respond to the time-based probe.\", \"disclosure_date\": \"2026-04-20\", \"fullname\": \"auxiliary/scanner/http/litellm_proxy_sqli\", \"is_install_path\": true, \"mod_time\": \"2026-06-19 07:54:56 +0000\", \"name\": \"BerriAI LiteLLM Proxy Pre-Auth SQL Injection Scanner\", \"needs_cleanup\": false, \"notes\": {\"Reliability\": [], \"SideEffects\": [\"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/auxiliary/scanner/http/litellm_proxy_sqli.rb\", \"platform\": \"\", \"post_auth\": false, \"rank\": 300, \"ref_name\": \"scanner/http/litellm_proxy_sqli\", \"references\": [\"CVE-2026-42208\", \"GHSA-r75f-5x8p-qvmc\", \"URL-https://bishopfox.com/blog/cve-2026-42208-pre-authentication-sql-injection-in-litellm-proxy\"], \"rport\": 4000, \"session_types\": false, \"targets\": null, \"type\": \"auxiliary\"}", "creation_timestamp": "2026-06-24T15:45:11.740978Z"} {"uuid": "8e78cef2-363e-4dc3-994e-8b872f5d9c95", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42208", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/litellm_proxy_sqli.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"\", \"author\": [\"Tencent YunDing Security Lab\", \"Kenneth LaCroix\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module detects BerriAI LiteLLM proxy servers affected by\\n CVE-2026-42208, an unauthenticated SQL injection. During API-key\\n verification the proxy interpolates the raw Authorization bearer value\\n into a PostgreSQL query (WHERE v.token = '') without\\n parameterization. Because LiteLLM only hashes tokens that begin with\\n \\\"sk-\\\", a bearer value that does not start with \\\"sk-\\\" reaches the query\\n verbatim and is injectable. The failure path that performs the lookup is\\n reachable before authentication. Affected versions are 1.81.16 through\\n 1.83.6 (fixed in 1.83.7).\\n\\n The module confirms the flaw with a benign time-based check built on the\\n framework's PostgreSQL time-based blind SQL injection library. It issues a\\n request whose injected predicate sleeps only when a tautology is true and a\\n second request whose predicate never sleeps, and reports the target\\n vulnerable only when the first is delayed while the second returns promptly.\\n A server that is merely slow delays both requests and is not flagged. The\\n module does not read or exfiltrate data.\\n\\n Detection requires the target to have provisioned at least one virtual\\n key. The injectable predicate sits in a WHERE clause that PostgreSQL\\n evaluates only against matching rows, so when the token table is empty\\n the pg_sleep never executes and the proxy appears (falsely) safe. Any\\n LiteLLM proxy in real use has issued keys; a freshly initialized proxy\\n with an empty token table may not respond to the time-based probe.\", \"disclosure_date\": \"2026-04-20\", \"fullname\": \"auxiliary/scanner/http/litellm_proxy_sqli\", \"is_install_path\": true, \"mod_time\": \"2026-06-19 07:54:56 +0000\", \"name\": \"BerriAI LiteLLM Proxy Pre-Auth SQL Injection Scanner\", \"needs_cleanup\": false, \"notes\": {\"Reliability\": [], \"SideEffects\": [\"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/auxiliary/scanner/http/litellm_proxy_sqli.rb\", \"platform\": \"\", \"post_auth\": false, \"rank\": 300, \"ref_name\": \"scanner/http/litellm_proxy_sqli\", \"references\": [\"CVE-2026-42208\", \"GHSA-r75f-5x8p-qvmc\", \"URL-https://bishopfox.com/blog/cve-2026-42208-pre-authentication-sql-injection-in-litellm-proxy\"], \"rport\": 4000, \"session_types\": false, \"targets\": null, \"type\": \"auxiliary\"}", "creation_timestamp": "2026-06-24T15:45:11.740978Z"} https://vulnerability.circl.lu/sighting/8e78cef2-363e-4dc3-994e-8b872f5d9c95/export Wed, 24 Jun 2026 15:45:11 +0000 https://vulnerability.circl.lu/sighting/753004a8-ba4d-4473-9e9f-3b38a7c479e2/export {"uuid": "753004a8-ba4d-4473-9e9f-3b38a7c479e2", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42208", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/e2963d00-0135-411d-946e-23b2d94ab954", "content": "", "creation_timestamp": "2026-06-23T14:03:38.202842Z"} {"uuid": "753004a8-ba4d-4473-9e9f-3b38a7c479e2", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42208", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/e2963d00-0135-411d-946e-23b2d94ab954", "content": "", "creation_timestamp": "2026-06-23T14:03:38.202842Z"} https://vulnerability.circl.lu/sighting/753004a8-ba4d-4473-9e9f-3b38a7c479e2/export Tue, 23 Jun 2026 14:03:38 +0000 https://vulnerability.circl.lu/sighting/c844f38b-c73f-44b2-b5cf-a8c23eadb0d1/export {"uuid": "c844f38b-c73f-44b2-b5cf-a8c23eadb0d1", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42208", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/9e55cfb4-5753-463c-8f44-a836a43cf5a1", "content": "", "creation_timestamp": "2026-06-19T12:45:12.186080Z"} {"uuid": "c844f38b-c73f-44b2-b5cf-a8c23eadb0d1", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42208", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/9e55cfb4-5753-463c-8f44-a836a43cf5a1", "content": "", "creation_timestamp": "2026-06-19T12:45:12.186080Z"} https://vulnerability.circl.lu/sighting/c844f38b-c73f-44b2-b5cf-a8c23eadb0d1/export Fri, 19 Jun 2026 12:45:12 +0000 https://vulnerability.circl.lu/sighting/98c9e650-1354-4b39-a5b3-f173b0717f8f/export {"uuid": "98c9e650-1354-4b39-a5b3-f173b0717f8f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42208", "type": "seen", "source": "MISP/d511a704-eba2-411a-9543-41e0e130f522", "content": "", "creation_timestamp": "2026-06-15T17:02:32.000000Z"} {"uuid": "98c9e650-1354-4b39-a5b3-f173b0717f8f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42208", "type": "seen", "source": "MISP/d511a704-eba2-411a-9543-41e0e130f522", "content": "", "creation_timestamp": "2026-06-15T17:02:32.000000Z"} https://vulnerability.circl.lu/sighting/98c9e650-1354-4b39-a5b3-f173b0717f8f/export Mon, 15 Jun 2026 17:02:32 +0000 https://vulnerability.circl.lu/sighting/5432c3bd-13cf-4fb7-b780-7759db2526ee/export {"uuid": "5432c3bd-13cf-4fb7-b780-7759db2526ee", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42208", "type": "confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-42208.yaml", "content": "", "creation_timestamp": "2026-05-30T06:53:06.000000Z"} {"uuid": "5432c3bd-13cf-4fb7-b780-7759db2526ee", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42208", "type": "confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-42208.yaml", "content": "", "creation_timestamp": "2026-05-30T06:53:06.000000Z"} https://vulnerability.circl.lu/sighting/5432c3bd-13cf-4fb7-b780-7759db2526ee/export Sat, 30 May 2026 06:53:06 +0000 https://vulnerability.circl.lu/sighting/ab650766-ea95-4cad-be0b-237c2327b8ce/export {"uuid": "ab650766-ea95-4cad-be0b-237c2327b8ce", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42208", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/86488", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a poc_cve-2026-42208\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a HAERIN-L\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0 | \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-30 04:51:40\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-30T05:00:03.000000Z"} {"uuid": "ab650766-ea95-4cad-be0b-237c2327b8ce", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42208", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/86488", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a poc_cve-2026-42208\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a HAERIN-L\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0 | \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-30 04:51:40\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-30T05:00:03.000000Z"} https://vulnerability.circl.lu/sighting/ab650766-ea95-4cad-be0b-237c2327b8ce/export Sat, 30 May 2026 05:00:03 +0000 https://vulnerability.circl.lu/sighting/6631759e-eef0-4be5-84e6-56236f707905/export {"uuid": "6631759e-eef0-4be5-84e6-56236f707905", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42208", "type": "seen", "source": "https://bsky.app/profile/cyberlensai.bsky.social/post/3mmnwq7vwio2k", "content": "CVE watch: CVE-2026-42208: BerriAI LiteLLM \u2014 BerriAI LiteLLM SQL Injection\u2026\n\nCheck exposure, dependency, and agent/tool access before panic-patching. Inventory beats vibes.\n\nSource: cisa.gov\nhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-42208", "creation_timestamp": "2026-05-25T07:17:43.535963Z"} {"uuid": "6631759e-eef0-4be5-84e6-56236f707905", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42208", "type": "seen", "source": "https://bsky.app/profile/cyberlensai.bsky.social/post/3mmnwq7vwio2k", "content": "CVE watch: CVE-2026-42208: BerriAI LiteLLM \u2014 BerriAI LiteLLM SQL Injection\u2026\n\nCheck exposure, dependency, and agent/tool access before panic-patching. Inventory beats vibes.\n\nSource: cisa.gov\nhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-42208", "creation_timestamp": "2026-05-25T07:17:43.535963Z"} https://vulnerability.circl.lu/sighting/6631759e-eef0-4be5-84e6-56236f707905/export Mon, 25 May 2026 07:17:43 +0000 https://vulnerability.circl.lu/sighting/f97d51e3-a347-4626-bfb2-4ed7502c3ba4/export {"uuid": "f97d51e3-a347-4626-bfb2-4ed7502c3ba4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42208", "type": "seen", "source": "Telegram/hQ1BgqlandqZtiBEN_8bc-Jqb7FATWW_NqNwwco7cLj54NM", "content": "", "creation_timestamp": "2026-05-23T03:00:04.000000Z"} {"uuid": "f97d51e3-a347-4626-bfb2-4ed7502c3ba4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42208", "type": "seen", "source": "Telegram/hQ1BgqlandqZtiBEN_8bc-Jqb7FATWW_NqNwwco7cLj54NM", "content": "", "creation_timestamp": "2026-05-23T03:00:04.000000Z"} https://vulnerability.circl.lu/sighting/f97d51e3-a347-4626-bfb2-4ed7502c3ba4/export Sat, 23 May 2026 03:00:04 +0000 https://vulnerability.circl.lu/sighting/bd38b5cd-0b80-4cb6-b7d8-0253396bbb52/export {"uuid": "bd38b5cd-0b80-4cb6-b7d8-0253396bbb52", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42208", "type": "seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mmhz2a5e5c27", "content": "CISA Adds One Known Exploited Vulnerability to Catalog\nRelease Date May 08, 2026\n\nCVE-2026-42208 BerriAI LiteLLM SQL Injection Vulnerability", "creation_timestamp": "2026-05-22T22:43:04.426563Z"} {"uuid": "bd38b5cd-0b80-4cb6-b7d8-0253396bbb52", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42208", "type": "seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mmhz2a5e5c27", "content": "CISA Adds One Known Exploited Vulnerability to Catalog\nRelease Date May 08, 2026\n\nCVE-2026-42208 BerriAI LiteLLM SQL Injection Vulnerability", "creation_timestamp": "2026-05-22T22:43:04.426563Z"} https://vulnerability.circl.lu/sighting/bd38b5cd-0b80-4cb6-b7d8-0253396bbb52/export Fri, 22 May 2026 22:43:04 +0000