CVE-2026-40217
LiteLLM guardrail tester allows sandbox escape
BerriAI · LiteLLM
First documented disclosure · Review checkpoint
Summary
Attackers probed the custom guardrail tester with payloads intended to reach unrestricted Python execution.
Severity and exploitation evidence
High · 8.8/10 · CVSS 3.1. Severity source.
Reported activity: Zenity observed malicious honeypot requests and reproduced payloads in a lab. Successful compromise of customer systems is not established.
Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.
How the weakness works
Source-text filtering could be bypassed through runtime construction and Python object behavior.
Conditions required
Authenticated access to the guardrail testing endpoint, including a guessed or exposed master key.
Potential impact
Commands run with proxy privileges, potentially root in the default container.
Affected versions and configurations
Zenity identifies 1.81.8 through versions before 1.83.10; the CNA identifies a vulnerable image digest.
Fix and mitigation status
1.83.10, per Zenity’s remediation and reproduction report.
Practical next steps
Upgrade, restrict the management endpoint, rotate default or exposed keys, and run the gateway without root privileges.
Operating lesson
A code guardrail needs an execution boundary, not only forbidden-word filtering.
Evidence and limits
X41 published April 8; April 10 is CVE publication and June 30 is campaign reporting. X41’s original page predates the available patch.
Related incident and research records
Related records can include laboratory demonstrations; a relationship does not itself establish exploitation.
Sources
- mitre CVE authority record
Primary source ·
- X41 original disclosure
Primary source ·
- Zenity telemetry and fix validation
Primary source ·