Loading vulnerability…
LiteLLM Custom Code Guardrails Remote Code Execution
CVE-2026-59821 is a post-authentication arbitrary-code-execution vulnerability in LiteLLM Custom Code Guardrails prior to version 1.82.0-stable. The production guardrail create and update flows compiled and executed administrator-supplied Python without applying the sandboxing, built-in restrictions, and forbidden-pattern validation used by the guardrail testing flow. Consequently, a user able to create or modify custom guardrails could execute arbitrary Python in the LiteLLM proxy environment.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation provides arbitrary code execution in the LiteLLM proxy container. In affected default container deployments, the proxy process may run as root, enabling root-level command execution within the container. An attacker could access secrets available to the process, including model-provider API credentials, and potentially abuse the workload identity or connected services accessible from the compromised environment.
If you can’t patch tonight, do this now.
Until patched, restrict Custom Code Guardrails creation and update operations to explicitly trusted administrators, configure a strong unique LiteLLM master key, and do not permit untrusted users to submit custom guardrail code. Remove LiteLLM management interfaces from public exposure, review existing guardrails for unauthorized code, restart affected instances to clear unexpected in-memory guardrail code, restrict container egress, and rotate potentially exposed provider API keys and cloud credentials.
Patch, then assume compromise.
Upgrade LiteLLM to version 1.82.0-stable or later. The fixed release enforces administrator-role authorization for Custom Code Guardrails operations and applies sandbox protections during guardrail registration.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.