LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks
LowCVE-2026-59821 · Published Jul 22, 2026 · updated Sep 10, 2026
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| litellm PyPI | < 1.82.0 | 1.82.0 |
Details and references
### Impact LiteLLM's Custom Code Guardrails production create/update paths did not apply the same sandboxing and validation used by the test endpoint. A privileged user with access to create or update guardrails could submit custom Python code that executed in the LiteLLM proxy environment. In deployments without a configured master key, callers could be treated as proxy administrators, making this reachable without intended administrative authorization. This could allow arbitrary code execution in the LiteLLM proxy container and exposure of secrets available to the process. ### Patches The issue is fixed in `1.82.0-stable`. LiteLLM recommend upgrading to `1.82.0-stable` or later. ### Workarounds If upgrading is not immediately possible: 1. Restrict access to `POST /guardrails` and `PUT /guardrails/{guardrail_id}` to trusted administrators only. 2. Ensure `LITELLM_MASTER_KEY` is configured. 3. Avoid enabling Custom Code Guardrails for untrusted users.
- CVSS 4.0
- CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-94
- Also known as
- CVE-2026-59821, PYSEC-2026-3478
More LiteLLM advisories
All LiteLLM| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Jul 22 | LiteLLM: Arbitrary file write via path traversal in Skills archive extraction CVE-2026-59820Mediumfixed in 1.83.7 | Medium | 1.83.7 |
| Jul 22 | LiteLLM: Local file read via request-supplied OIDC file references CVE-2026-59819Lowfixed in 1.83.10 | Low | 1.83.10 |
| Jul 22 | LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback CVE-2026-59822Highfixed in 1.84.0 | High | 1.84.0 |
| Jun 21 | BerriAI litellm has SSRF via Unvalidated spec_path URL in MCP OpenAPI Spec Loader CVE-2026-12798Low6.3no fix yet | Low6.3 | No fix yet |
| Jun 21 | BerriAI litellm: UI User Enumeration leads to System-Wide Information Disclosure CVE-2026-12799Low4.3no fix yet | Low4.3 | No fix yet |
| Jun 21 | BerriAI litellm has Security Feature Bypass in BannedKeywords and AzureContentSafety Guardrails via call_type Mismatch on Async Endpoints CVE-2026-12797Low6.3no fix yet | Low6.3 | No fix yet |