CVE-2026-59821: LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks
Impact
LiteLLM's Custom Code Guardrails production create/update paths did not apply the same sandboxing and validation used by the test endpoint.
A privileged user with access to create or update guardrails could submit custom Python code that executed in the LiteLLM proxy environment. In deployments without a configured master key, callers could be treated as proxy administrators, making this reachable without intended administrative authorization.
This could allow arbitrary code execution in the LiteLLM proxy container and exposure of secrets available to the process.
Patches
The issue is fixed in 1.82.0-stable.
LiteLLM recommend upgrading to 1.82.0-stable or later.
Workarounds
If upgrading is not immediately possible:
1. Restrict access to POST /guardrails and PUT /guardrails/{guardrailid} to trusted administrators only. 2. Ensure LITELLMMASTERKEY is configured. 3. Avoid enabling Custom Code Guardrails for untrusted users.
Other sources
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.82.0-stable, LiteLLM's Custom Code Guardrails production create and update paths did not apply the same sandboxing and validation used by the test endpoint, allowing a privileged user with access to create or update guardrails to submit custom Python code that executed in the LiteLLM proxy environment and could expose secrets available to the process. This issue is fixed in version 1.82.0-stable.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/litellmto a version that resolves this vulnerability.Fixed in 1.82.0 - Upgrade
Upgrade
LiteLLMto a version that resolves this vulnerability.Fixed in 1.82.0-stable - Configuration
Avoid enabling Custom Code Guardrails for untrusted users.
LiteLLM Custom Code Guardrails Custom Code Guardrails (enable/disable) = disabled - Configuration
Ensure LITELLM_MASTER_KEY is configured.
LiteLLM LITELLM_MASTER_KEY = configured - Compensating control
Restrict access to POST /guardrails and PUT /guardrails/{guardrail_id} to trusted administrators only.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-59821?
The severity of CVE-2026-59821 is classified as low with a CVSS score of 4.0.
How do I fix CVE-2026-59821?
To fix CVE-2026-59821, update LiteLLM to version 1.82.0-stable or later.
What are the potential risks associated with CVE-2026-59821?
The potential risks include bypassing code safety checks, which could lead to code injection vulnerabilities.
Which software is affected by CVE-2026-59821?
CVE-2026-59821 affects LiteLLM versions prior to 1.82.0-stable.
What component of LiteLLM is impacted by CVE-2026-59821?
CVE-2026-59821 impacts the Custom Code Guardrails production endpoints in LiteLLM.