LiteLLM proxy guardrail sandbox escape lets custom-code checks run arbitrary code, shipped with four more auth-bypass bugs

Undisclosed·LiteLLM proxy (self-hosted LLM/agent gateway) — custom-code guardrail engine, MCP stdio test endpoint, key-management and prompt-template endpointsFixed

BerriAI's LiteLLM proxy shipped five authenticated vulnerabilities fixed together in one release: the sandbox that runs admin-authored custom-code guardrails (Python checks meant to inspect/block agent prompts and completions) could be escaped to execute arbitrary code on the proxy host; a low-privileged internal_user could also create API keys scoped to admin-only routes, self-promote their own role via /user/update, run commands through an MCP stdio test endpoint, and inject server-side templates via /prompts/test.

Blast radius

No named victim organisation or exploitation total is disclosed. The disclosed blast radius is architectural: any self-hosted LiteLLM proxy running an unpatched version exposed a path from an authenticated low-privilege account to full proxy_admin control and, via the guardrail sandbox escape, to arbitrary code execution on the host running the LLM/agent gateway. The privilege-escalation flaw alone carries CVSS 3.1 8.8 (High).

Root cause

The guardrail feature let admins run custom Python inside a sandbox meant to isolate it from the host, but the isolation was incomplete; separately, role-based access checks on proxy admin endpoints (key creation, role updates, MCP test routes, prompt-template rendering) were not enforced consistently across the API surface.

How it was caught

Found and reported by external researchers through LiteLLM's huntr bug-bounty program, not through the vendor's own testing; disclosed alongside CVE-2026-47101 with no OSV-listed evidence of prior in-the-wild exploitation.

What changed

BerriAI patched all five issues in litellm v1.83.14-stable; OSV lists three fix commits (2220f3076a, 5190bd07eb, d910a95661) for the API-key privilege-escalation issue specifically.

Take-awayA guardrail or custom-code hook you let admins attach to an agent pipeline needs the same sandbox hardening as the model-serving path itself — a safety control that can be escaped becomes an RCE vector — and admin-role checks must be enforced at every endpoint individually, not assumed from a central gate.