---
schema_version: '1.0'
id: security-20260723-537f58
url: https://osv.dev/vulnerability/GHSA-72m8-9m7m-h278
url_hash: 537f587b29891a929f44fff8f3ebfb307294b7bdd003bac3d41715e722be2355
canonical_url: https://osv.dev/vulnerability/GHSA-72m8-9m7m-h278
source: osv:ghsa
category: security/library
category_raw: cve/library
region: null
tags:
- cve
- CVE-2026-59821
- GHSA-72m8-9m7m-h278
- severity:CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
- litellm
- PyPI
lang: en
published_at: '2026-07-22T22:38:55Z'
fetched_at: '2026-07-23T06:59:45.010921Z'
updated_at: '2026-07-23T06:59:55Z'
status: published
content_hash: 8a46aecc00208bae08a393e7ad23d137e4fe8c7c8943a1514d4c56c2c59e2b80
content_changed_at: null
license_note: full
summary: 'LiteLLM: Custom Code Guardrails production endpoints bypass code safety
  checks'
summary_source: rss
summary_en: 'LiteLLM: Custom Code Guardrails production endpoints bypass code safety
  checks'
entities:
- name: Code Pink
  type: organization
key_facts: []
related: []
related_auto:
- name: agent_n8n_1_bot
  type: person
  weight: 1.0
title: 'CVE-2026-59821: LiteLLM: Custom Code Guardrails production endpoints bypass
  code safety checks'
---

# CVE-2026-59821: LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks

## TL;DR
LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks

## Key Points
- cve / CVE-2026-59821 / GHSA-72m8-9m7m-h278 / severity:CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N / litellm / PyPI

## Details
**Severity:** CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
**Advisory:** GHSA-72m8-9m7m-h278 (CVE-2026-59821)

**Affected (your watchlist):**
- `PyPI:litellm` 1.72.6.post2 → fixed in 1.82.0 [docker/docker-strands]

**Details:**
### Impact

LiteLLM's Custom Code Guardrails production create/update paths did not apply the same sandboxing and validation used by the test endpoint.

A privileged user with access to create or update guardrails could submit custom Python code that executed in the LiteLLM proxy environment. In deployments without a configured master key, callers could be treated as proxy administrators, making this reachable without intended administrative authorization.

This could allow arbitrary code execution in the LiteLLM proxy container and exposure of secrets available to the process.

### Patches

The issue is fixed in `1.82.0-stable`.

LiteLLM recommend upgrading to `1.82.0-stable` or later.

### Workarounds

If upgrading is not immediately possible:

1. Restrict access to `POST /guardrails` and `PUT /guardrails/{guardrail_id}` to trusted administrators only.
2. Ensure `LITELLM_MASTER_KEY` is configured.
3. Avoid enabling Custom Code Guardrails for untrusted users.

**References:**
- https://github.com/BerriAI/litellm/security/advisories/GHSA-72m8-9m7m-h278
- https://nvd.nist.gov/vuln/detail/CVE-2026-59821
- https://github.com/BerriAI/litellm/commit/e50b4486d0f7aa0497185a1ebcdd2c91f1769eba
- https://github.com/BerriAI/litellm
- https://github.com/BerriAI/litellm/releases/tag/v1.82.0-stable

_Data: OSV.dev (upstream: ghsa) — https://osv.dev/vulnerability/GHSA-72m8-9m7m-h278_

## Source
元記事: [CVE-2026-59821: LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks](https://osv.dev/vulnerability/GHSA-72m8-9m7m-h278) — published 2026-07-22T22:38:55Z