Read the docs
TI-2026-42638 Aliases CVE-2026-59821GHSA-72m8-9m7m-h278

LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks

Priority LOW 13CWE-94Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Code execution
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-94.

Summary

LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.82.0-stable, LiteLLM's Custom Code Guardrails production create and update paths did not apply the same sandboxing and validation used by the test endpoint, allowing a privileged user with access to create or update guardrails to submit custom Python code that executed in the LiteLLM proxy environment and could expose secrets available to the process. This issue is fixed in version 1.82.0-stable.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00904 60th percentileScored 2026-11-07
Fix Fixed litellm (BerriAI): 1.82.0-stablelitellm (PyPI): 1.82.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
BerriAIlitellmbefore 1.82.0-stable1.82.0-stablePatch availableCNA
—litellm (PyPI)before 1.82.01.82.0Patch availableGHSA-72m8-9m7m-h278
  • litellm VendorBerriAI Affected before 1.82.0-stable Fixed in 1.82.0-stable Patch available CNA
  • litellm (PyPI) Vendor— Affected before 1.82.0 Fixed in 1.82.0 Patch available GHSA-72m8-9m7m-h278

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:litellm:litellm:*:*:*:*:*:*:*:*before 1.82.0VulnerableBerriAI
cpe:2.3:a:litellm:litellm:1.82.0:nightly:*:*:*:*:*:*1.82.0 nightlyVulnerableBerriAI
  • cpe:2.3:a:litellm:litellm:*:*:*:*:*:*:*:* Versions before 1.82.0 Vulnerable ·BerriAI
  • cpe:2.3:a:litellm:litellm:1.82.0:nightly:*:*:*:*:*:* Versions 1.82.0 nightly Vulnerable ·BerriAI

Remediation

  • Fix · CNA litellm (BerriAI) Fixed in 1.82.0-stable
  • Fix · GHSA-72m8-9m7m-h278 litellm (PyPI) Fixed in 1.82.0 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Not affected: 4 products
  • Exploit Intelligence
  • Lightspeed Core
  • Red Hat Ansible Automation Platform 2
  • Red Hat OpenShift AI (RHOAI)

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-59821
  2. 2026-10-03 Alias added: GHSA-72m8-9m7m-h278

References

Patch 2

Advisory 1

Other 2

  • TI-2026-26015 Trivy ecosystem supply chain briefly compromised KEVCVSS 4.0CRITICAL 9.4
  • TI-2026-30529 LiteLLM: SQL injection in Proxy API key verification KEVCVSS 4.0CRITICAL 9.3
  • TI-2026-30582 LiteLLM: Authenticated command execution via MCP stdio test endpoints KEVCVSS 4.0HIGH 8.7
  • TI-2026-42639 LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback KEVCVSS 4.0HIGH 8.8
  • TI-2024-05340 Remote Code Execution in BerriAI/litellm CVSS 3.1CRITICAL 9.8
  • TI-2024-02760 Server-Side Template Injection in BerriAI/litellm CVSS 3.0CRITICAL 9.8
See all 36 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences