BerriAI · litellm
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.82.0-stable, LiteLLM's Custom Code Guardrails production create and update paths did not apply the same sandboxing and validation used by the test endpoint, allowing a privileged user with access to create or update guardrails to submit custom Python code that executed in the LiteLLM proxy environment and could expose secrets available to the process. This issue is fixed in version 1.82.0-stable.
First seen exploited 18 days after disclosure.
3 related vulnerabilities in the same code over 2 years. The latest fix listed for litellm is 1.83.7.
Why these are linked: Link confidenceHow strong the evidence is that two CVEs are related. High: stated in the CVE text or linked in an advisory, or the same code was patched one release apart. Medium: the same code, or a version step plus a similar description. Low: similar description only.
Why these are linked: Link confidenceHow strong the evidence is that two CVEs are related. High: stated in the CVE text or linked in an advisory, or the same code was patched one release apart. Medium: the same code, or a version step plus a similar description. Low: similar description only.
No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.
1 package in 1 ecosystem. Main package: litellm.
Upgrade to 1.84.0 or later
Fixes this CVE and 6 other known vulnerabilities in this package (CVE-2024-6587, CVE-2026-35029, +4).
pip install "litellm>=1.84.0"First fixed in 1.82.0 for CVE-2026-59821.
| If you run | Upgrade to |
|---|---|
| All versions before 1.82.0 | 1.84.0first fix for this CVE: 1.82.0 |
“Up to” means the second version is the fix and is not affected.
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.