CVE-2026-40217: BerriAI LiteLLM remote code execution in guardrails component

CVE-2026-40217 · Severity: high · CVSS 8.8 · Published 2026-04-10

LiteLLM is a proxy tool used to manage and unify various Artificial Intelligence (AI) models. A security flaw in its 'guardrails' feature allows an authenticated user to bypass safety restrictions and run unauthorized code on the server. This could allow an attacker to take full control of the system, potentially accessing sensitive data or disrupting AI operations.

Technologies: Berriai LiteLLM, litellm (PyPI), Red Hat Lightspeed Core. Vendors: Berriai, PyPI, Red Hat.

Quick answers

Is CVE-2026-40217 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-40217 being exploited in the wild.
How severe is CVE-2026-40217?
High severity, with a CVSS score of 8.8, published 10 April 2026.
Which products and versions are affected?
Berriai LiteLLM >= 1.81.8, < 1.83.10, through 2026-04-08; litellm (PyPI) ECOSYSTEM:introduced=1.81.8,fixed=1.83.10.
Is there a fix for CVE-2026-40217?
Yes. litellm (PyPI): upgrade to 1.83.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-40217 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-40217?
Check whether you run Berriai LiteLLM, litellm (PyPI) or Red Hat Lightspeed Core at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • litellm (PyPI): upgrade to 1.83.10 or later
    pip install "litellm>=1.83.10"

Technical details

A sandbox escape vulnerability exists in the LiteLLM /guardrails/test_custom_code API endpoint. While the endpoint uses regex-based source code filtering to block dangerous Python functions and attributes, it fails to account for CPython bytecode manipulation. An authenticated attacker can use string concatenation to bypass regex filters and then utilize bytecode rewriting (via the gi_code attribute and code.replace method) to access restricted built-ins like __import__. This allows for arbitrary command execution (RCE) with the privileges of the LiteLLM process, which runs as root by default in Docker deployments. Red Hat has released patches for affected products including Ansible Automation Platform and OpenShift AI.

Affected products

  • BerriAI LiteLLM through 2026-04-08
  • Red Hat Red Hat Ansible Automation Platform 2.6
  • Red Hat Red Hat OpenShift AI 3.3
  • Red Hat Lightspeed Core

Identifiers

  • CVE-2026-40217
  • GHSA-wxxx-gvqv-xp7p
  • PYSEC-2026-2601

Timeline

  • 2026-02-13: other: Vulnerability identified and PoC created
  • 2026-04-08: disclosed: Public disclosure after embargo expired
  • 2026-04-10: advisory: CVE-2026-40217 published
  • 2026-06-09: patched: Red Hat released fix for Ansible Automation Platform (RHSA-2026:24866)
  • 2026-06-25: patched: Red Hat released fix for OpenShift AI (RHSA-2026:30056)

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.