CVE-2026-59821
highpriority · track · 29EPSS 0.009 · 60 %ileDEEUUSEPSS · scored 2026-10-26
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.82.0-stable, LiteLLM's Custom Code Guardrails production create and update paths did not apply the same sandboxing and validation used by the test endpoint, allowing a privileged user with access to create or update guardrails to submit custom Python code that executed in the LiteLLM proxy environment and could expose secrets available to the process. This issue is fixed in version 1.82.0-stable.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · low–high · 2.1–7.2
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (5)
Products and version ranges known to be affected.
advisories (3)
Vendor and ecosystem advisories describing this.
- WID-SEC-W-2026-2263LiteLLM: Mehrere SchwachstellenDeutsch2026-07-08csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in LiteLLM ausnutzen, um Informationen offenzulegen, Daten zu manipulieren, Code auszuführen und um Sicherheitsmaßnahmen zu umgehen.
- GHSA-72m8-9m7m-h278LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks2026-07-22ghsa · osvUS
### Impact LiteLLM's Custom Code Guardrails production create/update paths did not apply the same sandboxing and validation used by the test endpoint. A privileged user with access to create or update guardrails could submit custom Python code that executed in the LiteLLM proxy environment. In deployments without a configured master key, callers could be treated as proxy administrators, making this reachable without intended administrative authorization. This could allow arbitrary code execution in the LiteLLM proxy container and exposure of secrets available to the process. ### Patches The issue is fixed in `1.82.0-stable`. LiteLLM recommend upgrading to `1.82.0-stable` or later. ### Workarounds If upgrading is not immediately possible: 1. Restrict access to `POST /guardrails` and `PUT /guardrails/{guardrail_id}` to trusted administrators only. 2. Ensure `LITELLM_MASTER_KEY` is configured. 3. Avoid enabling Custom Code Guardrails for untrusted users.
- PYSEC-2026-3478LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks2026-07-23vendor · osvUS
### Impact LiteLLM's Custom Code Guardrails production create/update paths did not apply the same sandboxing and validation used by the test endpoint. A privileged user with access to create or update guardrails could submit custom Python code that executed in the LiteLLM proxy environment. In deployments without a configured master key, callers could be treated as proxy administrators, making this reachable without intended administrative authorization. This could allow arbitrary code execution in the LiteLLM proxy container and exposure of secrets available to the process. ### Patches The issue is fixed in `1.82.0-stable`. LiteLLM recommend upgrading to `1.82.0-stable` or later. ### Workarounds If upgrading is not immediately possible: 1. Restrict access to `POST /guardrails` and `PUT /guardrails/{guardrail_id}` to trusted administrators only. 2. Ensure `LITELLM_MASTER_KEY` is configured. 3. Avoid enabling Custom Code Guardrails for untrusted users.
also known as (6)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (10)
External citations — patches, advisories, analysis.
- https://github.com/BerriAI/litellm/commit/e50b4486d0f7aa0497185a1ebcdd2c91f1769ebacnnvd
- https://github.com/BerriAI/litellm/releasesPatchcnnvd
- https://github.com/BerriAI/litellm/releases/tag/v1.82.0-stablecnnvd
- https://github.com/BerriAI/litellm/security/advisories/GHSA-72m8-9m7m-h278cnnvd
- https://github.com/BerriAI/litellm/commit/e50b4486d0f7aa0497185a1ebcdd2c91f1769ebaenisa_euvd
- https://github.com/BerriAI/litellm/releases/tag/v1.82.0-stableenisa_euvd
- https://github.com/BerriAI/litellm/security/advisories/GHSA-72m8-9m7m-h278enisa_euvd
- https://github.com/BerriAI/litellm/commit/e50b4486d0f7aa0497185a1ebcdd2c91f1769ebaPatchnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan