CVE-2026-40217: berriai litellm Unprotected Alternate Channel
CVSS: 8.8v3.1HighModified
AliasesGHSA-wxxx-gvqv-xp7pPYSEC-2026-2601CGA-6vph-3236-r5f7CGA-wwc8-m5xr-69xqCGA-62pr-hpf4-cg5qCGA-957w-fc57-7cwcCGA-h5r4-6hr8-vh4xCGA-jwf3-66f9-vgcx
Published 10-04-2026Last modified 15-07-2026
Vulnerability summary
CVE-2026-40217 is a high (CVSS 8.8) Unprotected Alternate Channel vulnerability in berriai litellm. EPSS estimates a 3.40% chance of exploitation in the next 30 days, higher than 88.7% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
8.8/10
010
High · v3.1 (CVE.org)EPSS score
3.40%
0%100%
Low · -11.66 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1reference
Advisory lineage
Upstream 1 · Downstream 0 · Related 2Timeline
- 10-04-2026PublishedVulnerability first disclosed.
- 15-07-2026Last modifiedVulnerability information updated.
Description
LiteLLM through 2026-04-08 allows remote attackers to execute arbitrary code via bytecode rewriting at the /guardrails/test_custom_code URI.
CVSS metrics
8 scores · 5 sources · 2 versionsHigh 7.5Preferred score · OSV · Pypi (Ecosystem advisory) · calculated from vector
CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:NSourcesAll 3 agree
- OSV · WolfiEcosystem advisory · calculated7.5HighCVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- OSV · ChainguardEcosystem advisory · calculated7.5HighCVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
High 8.8Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HSourcesAll 5 agree
- OSV · PypiEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · WolfiEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · ChainguardEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- NVDNIST8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
3.40%
Chance of exploitation in the next 30 days
Percentile
89%
Versus all other CVEs
30-day change
-11.66 pp
From 15.06% on 20-09-2026
20-09-202620-10-2026
EPSS score3.40%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (x41-dsec.de)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-420Unprotected Alternate ChannelThe product protects a primary channel, but it does not use the same level of protection for an alternate channel.
- CWE-94Improper Control of Generation of Code ('Code Injection')The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Affected systems
Chainguard3 products
- airflow-3< 3.2.2-r7
- litellmAll versions (No fix recorded)
- litellm-compatAll versions (No fix recorded)
Berriai1 product
- litellmbb0639701796218a3447160e55c0f1097446e4e6085df7dfd39f476d4143743f
Litellm1 product
- litellm≤ 2026-04-08
PyPI1 product
- litellm≥ 1.81.8, < 1.83.10
Wolfi1 product
- airflow-3< 3.2.2-r7
5 vendors · 7 products
References
13 links
- github.com/BerriAI/litellmPACKAGE
Show all 13 references
- pypi.org/project/litellmPACKAGE