LiteLLM Custom-Code Guardrail Sandbox Escape (CVE-2026-40217)
LiteLLM proxy servers let admins upload custom Python code as 'guardrails' to filter or check requests, and test that code via an API endpoint before deploying it. A flaw in how that endpoint sandboxes the submitted code lets an attacker escape the sandbox and run arbitrary commands on the server itself.
How the attack works
An attacker sends a request to the /guardrails/test_custom_code endpoint with Python code disguised as a guardrail. The code contains sandbox-escape tricks, like walking through Python's internal class hierarchy (__subclasses__, __globals__, __builtins__) or rewriting bytecode, to break out of whatever restrictions the sandbox normally enforces. Once the code is compiled and run by the LiteLLM proxy, the attacker's payload executes with the same privileges as the proxy process itself, effectively giving them command execution (via os, subprocess, exec, eval, or compile calls) on the server.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- e8268aeb-c417-41d2-83bc-01a751c52026
- Severity
- Critical
- CVEs
- CVE-2026-40217
Why it matters
An attacker who reaches this endpoint can execute arbitrary code on the LiteLLM proxy host, which typically sits in front of production LLM traffic and holds API keys, routing configuration, and access to backend model providers. This can lead to full server compromise, credential theft, and disruption of every application routed through that proxy.
What you can do
- →Restrict access to /guardrails/test_custom_code to trusted administrators only, ideally behind network-level access controls, not just application auth.
- →Upgrade LiteLLM past the affected builds (vulnerable through 2026-04-08) as soon as a fix is available.
- →Audit any custom guardrail code already stored or submitted for os/subprocess/exec/eval/compile calls or dunder-attribute traversal, and remove or quarantine anything suspicious.
- →Log and alert on requests to guardrail test/compile endpoints that contain code-execution or sandbox-escape primitives.
Known benign look-alikes
- Security advisory or PR text quoting the CVE-2026-40217 sandbox-escape payload.
- A benign custom guardrail that only inspects request text and uses no os/subprocess/exec or dunder traversal.
- Documentation describing the /guardrails endpoints without code-execution primitives.