LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks
LiteLLM
More for LiteLLM RSS feed for LiteLLM
- Severity
- High, CVSS 7.2
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- Record
- CVE-2026-59821
- Affects
- LiteLLM
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- July 8, 2026
- Source last modified
- October 25, 2026
Description
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.82.0-stable, LiteLLM's Custom Code Guardrails production create and update paths did not apply the same sandboxing and validation used by the test endpoint, allowing a privileged user with access to create or update guardrails to submit custom Python code that executed in the LiteLLM proxy environment and could expose secrets available to the process. This issue is fixed in version 1.82.0-stable.
Description quoted from the NVD record.
Who is affected
Your organization is affected if it uses LiteLLM, made by BerriAI, a service that sits between your apps and the AI language model services they connect to. This flaw affects versions before 1.82.0-stable. It is in the custom code guardrails feature, which lets administrators add their own safety rules written as code. When guardrails are created or updated for normal use, the product does not apply the same safety checks it uses when testing them. A user with permission to create or update guardrails could submit code that runs on the LiteLLM server and could expose secrets the server can reach. This flaw is rated High.
What to do
- The person who installed or runs LiteLLM for your organization should find out which version is in use.
- If it is a version before
1.82.0-stable, update it to1.82.0-stable, the version that fixes this flaw. - If an IT provider or outside vendor runs LiteLLM for your organization, send them this advisory and ask when the update to
1.82.0-stablewill be done. - If you are not sure whether your organization uses LiteLLM, ask whoever set up your AI tools or manages your computers to check.
Analysis written from the source record as of October 25, 2026 and reviewed before publishing.