Patchfirst
Patchfirst
CVE-2026-59821 Low · 2.1 EPSS 0.9%

LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks

BerriAI · litellm

Official description · CVE.org

LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.82.0-stable, LiteLLM's Custom Code Guardrails production create and update paths did not apply the same sandboxing and validation used by the test endpoint, allowing a privileged user with access to create or update guardrails to submit custom Python code that executed in the LiteLLM proxy environment and could expose secrets available to the process. This issue is fixed in version 1.82.0-stable.

Breakdown
54.1 / 100
Exploited
Yes, in VulnCheck KEV
Reports
0
Tactics
0/15

First seen exploited 18 days after disclosure.

  1. Disclosedday 0
  2. First seen exploitedVulnCheck KEV evidence+18 days

See the family tree

A fix was bypassed or incomplete once over 2 years. The latest fix listed for litellm is 1.83.7.

Same bug familyLinked by evidence that a fix failed or the same code was patched again. Oldest first.

  1. CVE-2024-5710Improper Access Control in Team Management in berriai/litellm27 Jun 2024
  2. relatedMedium

    Why these are linked:

    CVE-2024-10188Denial of Service in BerriAI/litellm20 Mar 2025
  3. same family
    CVE-2025-0628Improper Authorization in BerriAI/litellm20 Mar 2025
  4. incomplete fixHigh

    Why these are linked:

    • Stated in the CVE textAffected by this issue is the function ui_view_users of the file litellm/proxy/management_endpoints/internal_user_endpoints.py of the component Incomplete Fix CVE-2025-0628.
    CVE-2026-12799BerriAI litellm Incomplete Fix CVE-⁠2025-⁠0628…21 Jun 2026
  5. same family
    This CVECVE-2026-59821LiteLLM: Custom Code Guardrails production endpoints bypass code…8 Jul 2026

Fixes in litellmPyPI package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

  1. 1.53.1.dev1CVE-2024-1018820 Mar 2025
  2. 1.56.2CVE-2024-898420 Mar 2025
  3. 1.61.15CVE-2025-062820 Mar 2025
  4. 1.82.0CVE-2026-598218 Jul 2026
  5. 1.83.0CVE-2026-350296 Apr 2026
  6. 1.83.0CVE-2026-350306 Apr 2026
  7. 1.83.7CVE-2026-3700427 Aug 2026Latest listed

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: litellm.

PyPIlitellmGHSA-72m8-9m7m-h278PYSEC-2026-3478

Upgrade to 1.84.0 or later

Fixes this CVE and 6 other known vulnerabilities in this package (CVE-2024-6587, CVE-2026-35029, +4).

pippip install "litellm>=1.84.0"

First fixed in 1.82.0 for CVE-2026-59821.

Affected versions

If you runUpgrade to
All versions before 1.82.01.84.0first fix for this CVE: 1.82.0

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

Also mentioned in 1 community threat pulse (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

References

3 links, grouped by NVD tag

x_refsource_CONFIRM 1

github.com/BerriAI/litellm/security/advisories/GHSA-72m8-9m7m-h278

x_refsource_MISC 2

github.com/BerriAI/litellm/commit/e50b4486d0f7aa0497185a1ebcdd2c91f1769ebagithub.com/BerriAI/litellm/releases/tag/v1.82.0-stable
↑ ↓ chooseEnter openEsc close