---
schema_version: '1.0'
id: security-20260724-cfd1d4
url: https://osv.dev/vulnerability/PYSEC-2026-3478
url_hash: cfd1d40ec5f5495accd515976884278c8053cb98f2bf1455257dc5858afa3536
canonical_url: https://osv.dev/vulnerability/PYSEC-2026-3478
source: osv:pypa
category: security/library
category_raw: cve/library
region: null
tags:
- cve
- CVE-2026-59821
- PYSEC-2026-3478
- severity:CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
- litellm
- PyPI
lang: en
published_at: '2026-07-23T11:41:48Z'
fetched_at: '2026-07-24T07:01:54.515150Z'
updated_at: '2026-07-24T07:02:21Z'
status: published
content_hash: fcacf72da8ab3769ea9716f2f9e5df52c38ddb39c5b107278f5851dea8008817
content_changed_at: null
license_note: full
summary: 'LiteLLM: Custom Code Guardrails production endpoints bypass code safety
  checks'
summary_source: rss
summary_en: 'LiteLLM: Custom Code Guardrails production endpoints bypass code safety
  checks'
entities:
- name: CVE-2026-44243
  type: data
- name: addcustomemojis
  type: UNKNOWN
- name: Code Pink
  type: organization
key_facts: []
related: []
related_auto:
- name: agent_n8n_1_bot
  type: person
  weight: 1.0
title: 'CVE-2026-59821: LiteLLM: Custom Code Guardrails production endpoints bypass
  code safety checks'
---

# CVE-2026-59821: LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks

## TL;DR
LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks

## Key Points
- cve / CVE-2026-59821 / PYSEC-2026-3478 / severity:CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N / litellm / PyPI

## Details
**Severity:** CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
**Advisory:** PYSEC-2026-3478 (CVE-2026-59821)

**Affected (your watchlist):**
- `PyPI:litellm` 1.72.6.post2 → fixed in 1.82.0 [docker/docker-strands]

**Details:**
### Impact

LiteLLM's Custom Code Guardrails production create/update paths did not apply the same sandboxing and validation used by the test endpoint.

A privileged user with access to create or update guardrails could submit custom Python code that executed in the LiteLLM proxy environment. In deployments without a configured master key, callers could be treated as proxy administrators, making this reachable without intended administrative authorization.

This could allow arbitrary code execution in the LiteLLM proxy container and exposure of secrets available to the process.

### Patches

The issue is fixed in `1.82.0-stable`.

LiteLLM recommend upgrading to `1.82.0-stable` or later.

### Workarounds

If upgrading is not immediately possible:

1. Restrict access to `POST /guardrails` and `PUT /guardrails/{guardrail_id}` to trusted administrators only.
2. Ensure `LITELLM_MASTER_KEY` is configured.
3. Avoid enabling Custom Code Guardrails for untrusted users.

**References:**
- https://github.com/BerriAI/litellm/security/advisories/GHSA-72m8-9m7m-h278
- https://nvd.nist.gov/vuln/detail/CVE-2026-59821
- https://github.com/BerriAI/litellm/commit/e50b4486d0f7aa0497185a1ebcdd2c91f1769eba
- https://github.com/BerriAI/litellm
- https://github.com/BerriAI/litellm/releases/tag/v1.82.0-stable
- https://pypi.org/project/litellm
- https://github.com/advisories/GHSA-72m8-9m7m-h278

_Data: OSV.dev (upstream: pypa) — https://osv.dev/vulnerability/PYSEC-2026-3478_

## Source
元記事: [CVE-2026-59821: LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks](https://osv.dev/vulnerability/PYSEC-2026-3478) — published 2026-07-23T11:41:48Z