LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks
PYSEC-2026-3478 · CVE-2026-59821 · GHSA-72m8-9m7m-h278
Published · Modified
AI SAST
Find this class of vulnerability in your own code
Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.
Description
Impact
LiteLLM's Custom Code Guardrails production create/update paths did not apply the same sandboxing and validation used by the test endpoint.
A privileged user with access to create or update guardrails could submit custom Python code that executed in the LiteLLM proxy environment. In deployments without a configured master key, callers could be treated as proxy administrators, making this reachable without intended administrative authorization.
This could allow arbitrary code execution in the LiteLLM proxy container and exposure of secrets available to the process.
Patches
The issue is fixed in 1.82.0-stable.
LiteLLM recommend upgrading to 1.82.0-stable or later.
Workarounds
If upgrading is not immediately possible:
- Restrict access to
POST /guardrailsandPUT /guardrails/{guardrail_id}to trusted administrators only. - Ensure
LITELLM_MASTER_KEYis configured. - Avoid enabling Custom Code Guardrails for untrusted users.
References
- WEB https://github.com/BerriAI/litellm/security/advisories/GHSA-72m8-9m7m-h278
- ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-59821
- WEB https://github.com/BerriAI/litellm/commit/e50b4486d0f7aa0497185a1ebcdd2c91f1769eba
- PACKAGE https://github.com/BerriAI/litellm
- WEB https://github.com/BerriAI/litellm/releases/tag/v1.82.0-stable
- PACKAGE https://pypi.org/project/litellm
- ADVISORY https://github.com/advisories/GHSA-72m8-9m7m-h278
Ready to move
Start Securing
Free, no credit card | First findings in minutes