CVE-2026-59821
published 2026-07-08CVE-2026-59821: LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.82.0-stable, LiteLLM's Custom Code Guardrails production…
PriorityP277high7.2CVSS 3.1
AVNACLPRHUINSUCHIHAH
ITWVulnCheck KEV
Exploited in the wild
EPSS
0.90%
59.5th percentile
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.82.0-stable, LiteLLM's Custom Code Guardrails production create and update paths did not apply the same sandboxing and validation used by the test endpoint, allowing a privileged user with access to create or update guardrails to submit custom Python code that executed in the LiteLLM proxy environment and could expose secrets available to the process. This issue is fixed in version 1.82.0-stable.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| berriai | litellm | < 1.82.0-stable | 1.82.0-stable |
| litellm | litellm | < 1.82.0 | 1.82.0 |
| litellm | litellm | — | — |
| litellm | litellm | >= 0 < 1.82.0 | 1.82.0 |
CVSS provenance
nvdv3.17.2HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
nvdv4.02.1LOWCVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vulncheck8.2HIGH
vendor_redhat2.1LOW
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
BerriAI litellm up to 1.65.4 Custom Code Guardrails sandbox (EUVD-2026-42350 / WID-SEC-2026-2263)
vuldb·2026-07-23·CVSS 7.2
CVE-2026-59821 [HIGH] BerriAI litellm up to 1.65.4 Custom Code Guardrails sandbox (EUVD-2026-42350 / WID-SEC-2026-2263)
A vulnerability was found in BerriAI litellm up to 1.65.4 and classified as problematic. This impacts an unknown function of the component Custom Code Guardrails. The manipulation results in sandbox issue.
This vulnerability was named CVE-2026-59821. The attack may be performed from remote. There is no available exploit.
It is suggested to upgrade the affected component.
GHSA
LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks
ghsa·2026-07-22
CVE-2026-59821 [LOW] CWE-94 LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks
LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks
### Impact
LiteLLM's Custom Code Guardrails production create/update paths did not apply the same sandboxing and validation used by the test endpoint.
A privileged user with access to create or update guardrails could submit custom Python code that executed in the LiteLLM proxy environment. In deployments without a configured master key, callers could be treated as proxy administrators, making this reachable without intended administrative authorization.
This could allow arbitrary code execution in the LiteLLM proxy container and exposure of secrets available to the process.
### Patches
The issue is fixed in `1.82.0-stable`.
LiteLLM recommend upgrading to `1.82.0-stable` or later.
### Workarounds
If upg
VulnCheck
litellm litellm Improper Authentication
vulncheck·2026·CVSS 8.2
CVE-2026-59822 [HIGH] litellm litellm Improper Authentication
litellm litellm Improper Authentication
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.84.0, LiteLLM's MCP Streamable HTTP endpoint allowed an unauthenticated attacker to use a fabricated Authorization header to trigger an OAuth2 passthrough fallback path that replaced failed LiteLLM key validation with an empty UserAPIKeyAuth() object, allowing requests to reach MCP tooling without a valid LiteLLM key. This issue is fixed in version 1.84.0.
Affected: litellm litellm
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://www.linkedin.com/posts/yaarashriki_cve-2026-59821-cve-2026-59822-i-found-activity-748
VulnCheck
litellm litellm Improper Control of Generation of Code ('Code Injection')
vulncheck·2026·CVSS 7.2
CVE-2026-59821 [HIGH] litellm litellm Improper Control of Generation of Code ('Code Injection')
litellm litellm Improper Control of Generation of Code ('Code Injection')
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.82.0-stable, LiteLLM's Custom Code Guardrails production create and update paths did not apply the same sandboxing and validation used by the test endpoint, allowing a privileged user with access to create or update guardrails to submit custom Python code that executed in the LiteLLM proxy environment and could expose secrets available to the process. This issue is fixed in version 1.82.0-stable.
Affected: litellm litellm
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://www.linked
Red Hat
litellm: LiteLLM: Arbitrary code execution and information disclosure via custom code guardrails
vendor_redhat·2026-07-08·CVSS 2.1
CVE-2026-59821 [LOW] CWE-94 litellm: LiteLLM: Arbitrary code execution and information disclosure via custom code guardrails
litellm: LiteLLM: Arbitrary code execution and information disclosure via custom code guardrails
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.82.0-stable, LiteLLM's Custom Code Guardrails production create and update paths did not apply the same sandboxing and validation used by the test endpoint, allowing a privileged user with access to create or update guardrails to submit custom Python code that executed in the LiteLLM proxy environment and could expose secrets available to the process. This issue is fixed in version 1.82.0-stable.
A flaw was found in LiteLLM, a proxy server for Large Language Model (LLM) APIs. A privileged user with access to create or update custom code guardrails could exploit this vulnerability. The flaw allowed
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-59821 litellm: LiteLLM: Arbitrary code execution and information disclosure via custom code guardrails
bugzilla·2026-07-08·CVSS 2.1
CVE-2026-59821 [LOW] CVE-2026-59821 litellm: LiteLLM: Arbitrary code execution and information disclosure via custom code guardrails
CVE-2026-59821 litellm: LiteLLM: Arbitrary code execution and information disclosure via custom code guardrails
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.82.0-stable, LiteLLM's Custom Code Guardrails production create and update paths did not apply the same sandboxing and validation used by the test endpoint, allowing a privileged user with access to create or update guardrails to submit custom Python code that executed in the LiteLLM proxy environment and could expose secrets available to the process. This issue is fixed in version 1.82.0-stable.
Hackernews
Nearly 1 in 10 Exposed LiteLLM Gateways Accepted the Example "sk-1234" Admin Key
blogs_hackernews·2026-09-10
CVE-2026-59821 Nearly 1 in 10 Exposed LiteLLM Gateways Accepted the Example "sk-1234" Admin Key
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## Nearly 1 in 10 Exposed LiteLLM Gateways Accepted the Example "sk-1234" Admin Key
Nearly one in ten of the internet-facing LiteLLM servers that Wiz Research scanned in February accepted sk-1234 , the example admin key in LiteLLM's own setup guide.
LiteLLM is an open-source AI gateway, the software a company puts between its applications and the model providers it pays for. That key is the gateway's administrator credential.
Anyone who holds it can read every model provider's API key stored on the server. In Wiz's tests, it also reached the cloud IAM credentials of the machine the gateway runs on.
Changing the key needs no u
Wiz
Off Guard: Breaking LiteLLM from authentication bypass to cloud compromise
blogs_wiz·2026-09-09·CVSS 7.2
CVE-2026-59822 [HIGH] Off Guard: Breaking LiteLLM from authentication bypass to cloud compromise
Nearly 1 in 10 publicly accessible LiteLLM instances accept a default master key or require no authentication at all. We found this while scanning roughly 3,000 internet-facing deployments of the most popular open-source LLM gateway. The usual concern with that kind of exposure is LLMjacking -someone using the credentials to run API calls on your bill - however, we wanted to check whether an attacker could do worse than that: could they achieve code execution on the host? Furthermore, could they exploit this to compromise the wider environment?
We decided to use Claude Code to work through LiteLLM's codebase, looking for features that accept user-controlled input and pass it to an execution context. We found multiple issues, as detailed below.
Key findings:
MCP authentication bypass via
2026-07-08
Published
Exploited in the wild