CVE-2025-45809: Litellm SQL Injection Vulnerability

CVE-2025-45809 Overview

CVE-2025-45809 is a SQL injection vulnerability in BerriAI LiteLLM versions prior to 1.81.0. The flaw resides in the /key/block and /key/unblock API endpoints, where the key parameter is passed to database queries without proper sanitization. Attackers can inject arbitrary SQL statements through this parameter, enabling unauthorized data access and manipulation. LiteLLM is a widely deployed proxy server that provides a unified interface for calling large language model (LLM) APIs across multiple providers. The vulnerability is tracked under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact
Attackers can execute arbitrary SQL commands against the LiteLLM database, exposing API keys, user data, and configuration information stored in the backend.

Affected Products

BerriAI LiteLLM versions prior to 1.81.0
LiteLLM 1.65.4 (confirmed vulnerable per CPE data)
Deployments exposing the /key/block and /key/unblock administrative endpoints

Discovery Timeline

2025-07-03 - CVE-2025-45809 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-45809

Vulnerability Analysis

The vulnerability affects the LiteLLM proxy server's key management API. The /key/block and /key/unblock endpoints accept a key parameter that identifies which API key to modify. Instead of using parameterized queries or an ORM layer with proper binding, the endpoints concatenate the user-supplied key value directly into SQL statements executed against the backend database.

Because LiteLLM stores sensitive material such as virtual API keys, usage records, and organizational metadata, successful SQL injection exposes credential material that could be used to pivot to upstream LLM providers. The endpoints require user interaction according to the CVSS vector, suggesting that authenticated or session-based access may be involved in triggering the injection path.

Root Cause

The root cause is failure to sanitize or parameterize input to database queries in the key management handlers. Input passed via the key parameter is trusted and interpolated into query strings, allowing SQL metacharacters and clauses to alter query semantics.

Attack Vector

An attacker sends crafted HTTP requests to the /key/block or /key/unblock endpoints with a malicious payload in the key parameter. The injected SQL is executed by the database engine with the privileges of the LiteLLM service account. Depending on the database driver and query context, attackers can read arbitrary tables, extract stored keys, or modify records. Refer to the Huntr Bounty Report and the GitHub SQL Injection Guide for reproduction details.

Detection Methods for CVE-2025-45809

Indicators of Compromise

HTTP requests to /key/block or /key/unblock containing SQL metacharacters such as single quotes, --, UNION, or SELECT in the key parameter
Unexpected database errors or long-running queries originating from the LiteLLM service account
Access log entries showing repeated requests to key management endpoints from a single source

Detection Strategies

Deploy web application firewall (WAF) rules that inspect POST bodies and query strings sent to /key/* routes for SQL injection signatures
Enable database query logging and alert on syntactically anomalous statements referencing the LiteLLM key tables
Correlate authentication events with subsequent administrative API calls to flag suspicious session activity

Monitoring Recommendations

Forward LiteLLM proxy logs and database audit logs to a centralized SIEM for retention and correlation
Alert on any successful response from /key/block or /key/unblock that follows a request containing injection patterns
Monitor egress traffic from the LiteLLM host to detect exfiltration of extracted database contents

How to Mitigate CVE-2025-45809

Immediate Actions Required

Upgrade BerriAI LiteLLM to version 1.81.0 or later immediately
Rotate all virtual API keys and upstream provider credentials stored in the LiteLLM database
Restrict network exposure of the LiteLLM admin endpoints to trusted management networks only
Review historical access logs for requests to /key/block and /key/unblock predating the patch

Patch Information

The issue is fixed in LiteLLM 1.81.0. Users should update through their package manager, container image, or deployment pipeline. See the vendor advisory for technical remediation notes.

Workarounds

Place the LiteLLM proxy behind an authenticating reverse proxy that blocks direct access to /key/* endpoints
Apply WAF signatures that reject requests containing SQL metacharacters in the key parameter
Enforce least-privilege database credentials so the LiteLLM service account cannot read tables outside its required scope

bash

# Upgrade LiteLLM to a patched version
pip install --upgrade 'litellm>=1.81.0'

# Verify the installed version
python -c "import litellm; print(litellm.__version__)"