Skip to content
Fencer Vulns
high 8.8

CVE-2026-40217 in the critical feed json

LiteLLM has a sandbox escape in custom-code guardrail

published 2026-04-10 6 mo ago modified 2026-10-26 13 d ago also GHSA-wxxx-gvqv-xp7p , PYSEC-2026-2601 , EUVD-2026-21376

cvss
8.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
17.0%
EPSS 17.0% chance of exploitation in 30 days, percentile 97%
public exploits
0
none known, plus a Nuclei check

Summary

LiteLLM through 2026-04-08 allows remote attackers to execute arbitrary code via bytecode rewriting at the /guardrails/test_custom_code URI.

Patch / fix

  • pypi litellm 1.83.10
  • Red Hat Red Hat Ansible Automation Platform 2.6 1780102732
  • Red Hat Red Hat OpenShift AI 3.3 1782310008

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-40217 updated cvss 8.8

LiteLLM: LiteLLM: Arbitrary Code Execution via bytecode rewriting

  • Red Hat Lightspeed Core redhat-user-workloads/lightspeed-core-tenant/lightspeed-stack Red Hat Ansible Automation Platform 2 redhat-user-workloads/ansible-tenant/ansible-automation-platform-26/lightspeed-chatbot-rhel9
    affected: workaround, no fix available
  • Red Hat Ansible Automation Platform 2.6 ansible-automation-platform-26/lightspeed-chatbot-rhel9 1780102732
    fixed: vendor fix RHSA-2026:24866
  • Red Hat OpenShift AI 3.3 rhoai/odh-llama-stack-core-rhel9 1782310008
    fixed: vendor fix RHSA-2026:30056
  • Red Hat Ansible Automation Platform 2.6 ansible-automation-platform-26/hub-rhel9 1779761061, ansible-automation-platform-26/gateway-rhel9 1779773804, ansible-automation-platform-26/hub-web-rhel9 1779765164, ansible-automation-platform-26/receptor-rhel9 1779770938, ansible-automation-platform-26/mcp-tools-rhel9 1779772877, ansible-automation-platform-26/controller-rhel9 1779762270, +23 more
    not affected: vulnerable code not present
  • Red Hat OpenShift AI (RHOAI) rhoai/odh-mlflow-rhel9
    not affected: component not present
  • Red Hat OpenShift AI 3.3 rhoai/odh-rhel9-operator 1782332088, rhoai/odh-operator-bundle 1782332801
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
total
Assessed
4 mo ago

Exploit prediction

17.02% chance of exploitation in the next 30 days, higher than 97% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • Nuclei template LiteLLM < 1.25.0 - Remote Code Execution nuclei detection template
  • x41-dsec.de https://www.x41-dsec.de/lab/advisories/x41-2026-001-litellm/ referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CISA ADP 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
GitHub 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
OSV 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
pypi litellm
>=1.81.8, <1.83.10
1.83.10

Affected products

  • BerriAI LiteLLM
  • Red Hat Red Hat Ansible Automation Platform 2.6
  • Red Hat Red Hat OpenShift AI 3.3
  • Red Hat Lightspeed Core
  • Red Hat Red Hat OpenShift AI (RHOAI)

Classification

Weakness
  • CWE-420 Unprotected Alternate Channel
  • CWE-94 Improper Control of Generation of Code
  • CWE-913 Improper Control of Dynamically-Managed Code Resources

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.