Junglewise Threat Intelligence

CVE-2026-40217: BerriAI LiteLLM remote code execution in guardrails component

CVE-2026-40217 · Severity: high · CVSS 8.8 · Published 2026-04-10

Technologies: Berriai LiteLLM, Red Hat Lightspeed Core. Vendors: Berriai, Red Hat, PyPI.

Executive brief

LiteLLM is a proxy tool used to manage and unify various Artificial Intelligence (AI) models. A security flaw in its 'guardrails' feature allows an authenticated user to bypass safety restrictions and run unauthorized code on the server. This could allow an attacker to take full control of the system, potentially accessing sensitive data or disrupting AI operations.

Technical details

A sandbox escape vulnerability exists in the LiteLLM /guardrails/test_custom_code API endpoint. While the endpoint uses regex-based source code filtering to block dangerous Python functions and attributes, it fails to account for CPython bytecode manipulation. An authenticated attacker can use string concatenation to bypass regex filters and then utilize bytecode rewriting (via the gi_code attribute and code.replace method) to access restricted built-ins like __import__. This allows for arbitrary command execution (RCE) with the privileges of the LiteLLM process, which runs as root by default in Docker deployments. Red Hat has released patches for affected products including Ansible Automation Platform and OpenShift AI.

Affected products

  • BerriAI LiteLLM through 2026-04-08
  • Red Hat Red Hat Ansible Automation Platform 2.6
  • Red Hat Red Hat OpenShift AI 3.3
  • Red Hat Lightspeed Core

Timeline

  • 2026-02-13: other: Vulnerability identified and PoC created
  • 2026-04-08: disclosed: Public disclosure after embargo expired
  • 2026-04-10: advisory: CVE-2026-40217 published
  • 2026-06-09: patched: Red Hat released fix for Ansible Automation Platform (RHSA-2026:24866)
  • 2026-06-25: patched: Red Hat released fix for OpenShift AI (RHSA-2026:30056)

References

Related threats