Free AI Safety Workshop — in collaboration with explainx.aiSave your seat
AgentbeamBeta
AI agent vulnerability · LiteLLM

CVE-2026-59821: LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks

lowCVSS 4.0 2.1GHSA-72m8-9m7m-h278

Impact LiteLLM's Custom Code Guardrails production create/update paths did not apply the same sandboxing and validation used by the test endpoint. A privileged user with access to create or update guardrails could submit custom Python code that executed in the LiteLLM proxy environment.

Published Jul 22, 2026

Affected packages

litellm

Ecosystem
PyPI
Affected
< 1.82.0
Fixed in
1.82.0
Check
pip show litellm

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

Impact

LiteLLM's Custom Code Guardrails production create/update paths did not apply the same sandboxing and validation used by the test endpoint.

A privileged user with access to create or update guardrails could submit custom Python code that executed in the LiteLLM proxy environment. In deployments without a configured master key, callers could be treated as proxy administrators, making this reachable without intended administrative authorization.

This could allow arbitrary code execution in the LiteLLM proxy container and exposure of secrets available to the process.

Patches

The issue is fixed in 1.82.0-stable.

LiteLLM recommend upgrading to 1.82.0-stable or later.

Workarounds

If upgrading is not immediately possible:

  1. Restrict access to POST /guardrails and PUT /guardrails/{guardrail_id} to trusted administrators only.
  2. Ensure LITELLM_MASTER_KEY is configured.
  3. Avoid enabling Custom Code Guardrails for untrusted users.

Credited to yaaras.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More LiteLLM vulnerabilities

All LiteLLM entries