EUVD-2026-21376
GHSA-3926-2jvf-fg29
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to LiteLLM application
-
DeliveryAccess /guardrails/test_custom_code endpoint
-
ExploitSubmit malicious bytecode payload
-
ExecutionRewrite and execute arbitrary code
-
ImpactAchieve remote code execution with full privileges
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V13 - Configuration Unprotected alternate channel
|
| Exploitation Conditions | Authenticated user access required to LiteLLM through 2026-04-08. Attacker must have valid credentials to reach the /guardrails/test_custom_code endpoint and submit malicious bytecode for rewriting. No victim interaction needed. Remote network access. |
| Impact | CVSS 8.8 high severity RCE affecting authenticated LiteLLM users via bytecode rewriting at /guardrails/test_custom_code. Requires valid credentials but grants full system compromise (integrity, confidentiality, availability). Moderate observed exploitation activity increases urgency for patched deployments. |
| Exploit ScenarioDerived | Authenticated attacker submits malicious Python bytecode to /guardrails/test_custom_code endpoint. LiteLLM processes and executes bytecode without proper validation, achieving remote code execution on the server. No public exploit code identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 10, 2026
Remote code execution in BerriAI LiteLLM (all versions through 2026-04-08) enables authenticated attackers to execute arbitrary code by exploiting bytecode rewriting functionality at the /guardrails/test_custom_code endpoint. The vulnerability requires low-privilege authentication (PR:L) but permits complete system compromise with high impact to confidentiality, integrity, and availability. No public exploit identified at time of analysis.
RemediationAI
Upstream fix available (PR/commit); released patched version not independently confirmed. Immediate action required: Restrict network access to /guardrails/test_custom_code endpoint through web application firewall rules or reverse proxy configuration, limiting exposure to trusted administrative IP ranges only. If custom guardrails testing is not operationally required, disable the endpoint entirely via application configuration. Implement strict input validation and bytecode execution sandboxing if the feature must remain accessible. Monitor application logs for unauthorized access attempts to /guardrails/ paths. Consult vendor security advisory for official remediation guidance: https://www.x41-dsec.de/lab/advisories/x41-2026-001-litellm/
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in pypi
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Root cause stems from CWE-420 (Unprotected Alternate Channel) where the /guardrails/test_custom_code URI accepts user-controlled bytecode for rewriting without adequate sandboxing or validation. Authenticated users can submit malicious bytecode payloads that execute with application privileges, bypassing intended security boundaries in the guardrails testing interface.
Know when Litellm gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
DescriptionCVE.org
LiteLLM through 2026-04-08 allows remote attackers to execute arbitrary code via bytecode rewriting at the /guardrails/test_custom_code URI.
Blast Radius
ecosystem impact- 2 pypi packages depend on litellm (2 direct, 0 indirect)
Ecosystem-wide dependent count for version 1.81.8.
Executive ViewAI
BerriAI LiteLLM versions through April 8, 2026 contain a remote code execution vulnerability in its guardrails testing functionality that allows authenticated users to execute arbitrary code and compromise system confidentiality, integrity, and availability. Organizations deploying LiteLLM in production environments face immediate risk of unauthorized code execution by any user with application access, potentially leading to data exfiltration, service disruption, or lateral movement within the infrastructure.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict /guardrails/test_custom_code endpoint to localhost or internal-only networks via network segmentation or WAF rules; (2) Disable the endpoint entirely if not critical to operations; (3) Implement strict role-based access controls limiting endpoint access to administrative users only; (4) Enable authentication logging and alerting for all requests to this endpoint; (5) Run LiteLLM in a sandboxed or containerized environment with restrictive process-level permissions to limit blast radius of code execution.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Remote command execution in LiteLLM proxy server versions 1.74.2 through 1.83.6 allows any authenticated user to execute
SQL injection in LiteLLM proxy server versions 1.81.16 through 1.83.6 allows unauthenticated remote attackers to read an
Authentication bypass in LiteLLM (BerriAI) proxy/AI Gateway before 1.84.0 lets a remote unauthenticated attacker reach M
BerriAI/litellm is vulnerable to Server-Side Template Injection (SSTI) via the `/completions` endpoint. Rated critical s
BerriAI's litellm, in its latest version, is vulnerable to arbitrary file deletion due to improper input validation on t
Authentication bypass in the LiteLLM proxy lets any party who already holds a valid JWT issued by the configured externa
In berriai/litellm version v1.52.1, an issue in proxy_server.py causes the leakage of Langfuse API keys when an error oc
In berriai/litellm before version 1.44.12, the `litellm/litellm_core_utils/litellm_logging.py` file contains a vulnerabi
A Server-Side Request Forgery (SSRF) vulnerability exists in berriai/litellm version 1.38.10. Rated high severity (CVSS
An SQL Injection vulnerability exists in the berriai/litellm repository, specifically within the `/global/spend/logs` en
A code injection vulnerability exists in the berriai/litellm application, version 1.34.6, due to the use of unvalidated
berriai/litellm version 1.34.34 is vulnerable to improper access control in its team management functionality. Rated med
Exploit-DB