The vulnerability arises when a database query that validates proxy API keys incorporates caller‑supplied key values directly into the statement. An attacker can send a specially crafted Authorization header to any LLM API route handled by the proxy, triggering the vulnerable query and inserting arbitrary SQL code. Successful exploitation allows the attacker to read records from the proxy’s database and potentially modify or delete data, effectively granting unauthorized control over the proxy and its stored credentials.

This flaw affects systems that use the LiteLLM library, an open‑source LLM proxy maintained by BerriAI. Any deployment that has not yet applied the official fix for the malformed query is vulnerable, especially those exposing the proxy API to untrusted networks.

With a CVSS score of 9.8 the issue is rated critical. The attack does not require authentication and relies on a standard HTTP header, making exploitation straightforward for a skilled adversary. The EPSS score is not available, and the vulnerability is not yet listed in the CISA KEV catalog. Attacker can discover the proxy endpoint, craft the malicious payload, and gain full read/write access to the database without prior credentials.