CVE-2026-42203: LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.80.5 to before vers
Summary
LiteLLM is a proxy server (a middleman that forwards requests to AI language model APIs) that had a security flaw in versions 1.80.5 through 1.83.6 in its POST /prompts/test endpoint. This endpoint took user-supplied prompt templates and ran them without sandboxing (isolating them in a restricted environment), allowing attackers with valid API keys to execute arbitrary code (running any commands they want) on the server, potentially stealing secrets like API keys or database passwords.
Solution / Mitigation
Upgrade to version 1.83.7 or later. According to the source: 'This issue has been patched in version 1.83.7.'
Vulnerability Details
EPSS: 0.0%
May 8, 2026
Classification
Affected Vendors
Related Issues
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-42203
First tracked: May 8, 2026 at 02:12 AM
Classified by LLM (prompt v3) · confidence: 95%