GHSA-72M8-9M7M-H278

Vulnerability from github – Published: 2026-07-22 22:38 – Updated: 2026-07-22 22:38
VLAI
Summary
LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks
Details

Impact

LiteLLM's Custom Code Guardrails production create/update paths did not apply the same sandboxing and validation used by the test endpoint.

A privileged user with access to create or update guardrails could submit custom Python code that executed in the LiteLLM proxy environment. In deployments without a configured master key, callers could be treated as proxy administrators, making this reachable without intended administrative authorization.

This could allow arbitrary code execution in the LiteLLM proxy container and exposure of secrets available to the process.

Patches

The issue is fixed in 1.82.0-stable.

LiteLLM recommend upgrading to 1.82.0-stable or later.

Workarounds

If upgrading is not immediately possible:

  1. Restrict access to POST /guardrails and PUT /guardrails/{guardrail_id} to trusted administrators only.
  2. Ensure LITELLM_MASTER_KEY is configured.
  3. Avoid enabling Custom Code Guardrails for untrusted users.
Severity
2.1 (Low)
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "litellm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.82.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-59821"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-22T22:38:55Z",
    "nvd_published_at": "2026-07-08T20:16:57Z",
    "severity": "LOW"
  },
  "details": "### Impact\n\nLiteLLM\u0027s Custom Code Guardrails production create/update paths did not apply the same sandboxing and validation used by the test endpoint.\n\nA privileged user with access to create or update guardrails could submit custom Python code that executed in the LiteLLM proxy environment. In deployments without a configured master key, callers could be treated as proxy administrators, making this reachable without intended administrative authorization.\n\nThis could allow arbitrary code execution in the LiteLLM proxy container and exposure of secrets available to the process.\n\n### Patches\n\nThe issue is fixed in `1.82.0-stable`.\n\nLiteLLM recommend upgrading to `1.82.0-stable` or later.\n\n### Workarounds\n\nIf upgrading is not immediately possible:\n\n1. Restrict access to `POST /guardrails` and `PUT /guardrails/{guardrail_id}` to trusted administrators only.\n2. Ensure `LITELLM_MASTER_KEY` is configured.\n3. Avoid enabling Custom Code Guardrails for untrusted users.",
  "id": "GHSA-72m8-9m7m-h278",
  "modified": "2026-07-22T22:38:55Z",
  "published": "2026-07-22T22:38:55Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/BerriAI/litellm/security/advisories/GHSA-72m8-9m7m-h278"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59821"
    },
    {
      "type": "WEB",
      "url": "https://github.com/BerriAI/litellm/commit/e50b4486d0f7aa0497185a1ebcdd2c91f1769eba"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/BerriAI/litellm"
    },
    {
      "type": "WEB",
      "url": "https://github.com/BerriAI/litellm/releases/tag/v1.82.0-stable"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.