| Component | LiteLLM |
| Severity | high (CVSS 7.2) |
| CVSS vector | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
| Published (NVD) | 2026-07-08 |
| Last modified | 2026-07-13 |
| Affected versions | litellm < 1.82.0 litellm = 1.82.0 |
| Fixed in | 1.82.0 |
| Weakness | CWE-94 |
| CISA KEV | not listed |
NVD description
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.82.0-stable, LiteLLM's Custom Code Guardrails production create and update paths did not apply the same sandboxing and validation used by the test endpoint, allowing a privileged user with access to create or update guardrails to submit custom Python code that executed in the LiteLLM proxy environment and could expose secrets available to the process. This issue is fixed in version 1.82.0-stable.
What to do
- Upgrade LiteLLM to
1.82.0or later. - Do not expose the component's API or UI to the internet without authentication in front of it.
Sources
- NVD: CVE-2026-59821
- https://github.com/BerriAI/litellm/security/advisories/GHSA-72m8-9m7m-h278
- https://github.com/BerriAI/litellm/commit/e50b4486d0f7aa0497185a1ebcdd2c91f1769eba
- https://github.com/BerriAI/litellm/releases/tag/v1.82.0-stable
Read more
Other LiteLLM CVEs
A vulnerability has been found in BerriAI LiteLLM up to 1.94.0. This affects the function get_secret of the file secret_managers/main.py of...
A flaw has been found in BerriAI LiteLLM up to 1.95.0. Affected by this issue is the function ui_view_session_spend_logs of the file litellm...
LiteLLM contains a weak authentication vulnerability that allows an attacker holding a valid JWT from the configured identity provider to au...
BerriAI LiteLLM before 1.101.0-rc.1 contains a tenant isolation bypass vulnerability in the semantic cache layer that allows authenticated u...
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.83.9, an authenticated LiteLLM Proxy caller...
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to versions 1.88.6 and 1.96.2, any authenticated...