What’s Vulnerable › Vulnerabilities

CVE-2026-59821: LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks

• Severity: high (CVSS 7.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-08 · updated 2026-10-25
• Weakness: CWE-94

Description

LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.82.0-stable, LiteLLM's Custom Code Guardrails production create and update paths did not apply the same sandboxing and validation used by the test endpoint, allowing a privileged user with access to create or update guardrails to submit custom Python code that executed in the LiteLLM proxy environment and could expose secrets available to the process. This issue is fixed in version 1.82.0-stable.

Affected products

• BerriAI litellm: before 1.82.0; 1.82.0-nightly — fixed in 1.82.0

How to fix

Upgrade to a fixed version: BerriAI litellm 1.82.0. Check the vendor advisory for mitigations.

References

• https://github.com/BerriAI/litellm/commit/e50b4486d0f7aa0497185a1ebcdd2c91f1769eba
• https://github.com/BerriAI/litellm/releases/tag/v1.82.0-stable
• https://github.com/BerriAI/litellm/security/advisories/GHSA-72m8-9m7m-h278

Get alerted when CVE-2026-59821 or the next vulnerability affects your stack