CVE-2026-59821: LiteLLM code injection through Custom Code Guardrails create and update

Summary

CVE-2026-59821 affects LiteLLM, an AI Gateway proxy server, before 1.82.0-stable. Its Custom Code Guardrails production create and update paths skipped the sandboxing and validation applied by the test endpoint, so a privileged user who can create or update guardrails can submit Python code that runs in the LiteLLM proxy environment and may expose secrets available to the process. The weakness is classified as CWE-94, Improper Control of Generation of Code.

Mitigation

Fixed in version 1.82.0-stable.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

• litellmPyPILLM dependency since 2023-07-27 · 54 tracked dependents

Coverage

News, research and other items that mention CVE-2026-59821.

• Top MCP security resources — October 2026Adversa AI Blog · 2026-10-08
• Off Guard: Breaking LiteLLM from authentication bypass to cloud compromiseWiz Research Blog · 2026-09-09

Related items

• MediumWhen LLM Gateways Go Wrong: Findings from LiteLLMSimilar attack · Check Point Research
• HighCVE-2026-109403: conductor-oss conductor server-side request forgery in agent card fetchingSimilar attack · NVD/CVE Database
• InfoExploring Backdoor Vulnerabilities and Fairness Challenges in Generative Models: A SurveySimilar attack · ACM Digital Library (TOPS, DTRAP, CSUR)
• LowSmall AI Models Could Soon Self-Replicate on IoT Devices, Anthropic WarnsSimilar attack · SecurityWeek
• MediumCVE-2026-108940: Mistral.rs path traversal through calibration_apply save_cimatrix argumentSimilar attack · NVD/CVE Database