SECURITY_THREAT_PULSE
LIVE
LAST UPDATED
FIRST SEEN
4 SOURCES ON THIS EVENT
◆ WATCHCVE-2026-40217 · CVSS 8.8

BerriAI LiteLLM: attackers can run their own code

AFFECTSBerriAI LiteLLM

WHAT IT IS · AI TOOLSIt connects to AI models and often holds the keys to paid services and data.

DO THIS FIRSTUpdate it and change any API keys stored in it. Not sure if you use it? Send this page to your IT provider or security lead and ask.

TECHNICAL SUMMARY LiteLLM through 2026-04-08 allows remote attackers to execute arbitrary code via bytecode rewriting at the /guardrails/test_custom_code URI.

WHY THIS VERDICT Attacks are reported but not confirmed by an authoritative source, and the vulnerability is more than 90 days old.

WHY IT RANKS HERE Exploitation is reported. Ready-made attack tools are public. The first report is 5 days old.

HIGHEST CONFIRMED RUNG
NOTHING YET
CISA KEV
NOT YET
EXPLOIT CODE
READY TO USE
// EVIDENCE LADDER

How far has it climbed?

CONFIRMED
REPORTED
NO EVIDENCE

  1. 01 TALK

    □ NO EVIDENCE YET
    NEWEST EVIDENCE NONE YET

    No evidence yet.

    SRC: NONE YET

  2. 02 EXPOSED

    □ NOT TRACKED YET
    NO SOURCE FOR THIS STEP YET

    We have no source that counts exposed systems yet. Internet scan data needs a partnership we do not have. No evidence here does not mean nothing is exposed.

  3. 03 TRIED

    ▨ REPORTED, NOT CONFIRMED
    NEWEST EVIDENCE · 1 SOURCE

    Attacks that worked are reported (step 4), so attempts count as reported too.

  4. 04 EXPLOITED

    ▨ REPORTED, NOT CONFIRMED
    NEWEST EVIDENCE · 1 SOURCE

    Exploitation of CVE-2026-40217 reported (CIRCL sighting).

  5. 05 DAMAGE

    □ NOT TRACKED YET
    NO SOURCE FOR THIS STEP YET

    Breach notices and filings rarely name the flaw that was used, so we cannot link them to this event yet. No evidence here does not mean no harm.

// THE CLOCK

When each thing happened

  1. DISCLOSED
    CVE-2026-40217 published
  2. EXPLOIT CODE PUBLIC
    DATE UNKNOWN
  3. FIRST ATTACK REPORT
    CIRCL Vulnerability-Lookup sightings
  4. CISA KEV LISTING
    NOT YET
  5. US FEDERAL DEADLINE
    NOT YET
Attacks were reported 210 days after disclosure.
// ASK YOUR TEAM

Questions to ask this week

// TIMELINE · PACIFIC TIME

How it unfolded

  1. APR 10, 2026
    CISA Vulnrichment notes a public proof of concept for CVE-2026-40217
  2. MAY 19, 2026
    1 public GitHub repository claims a proof of concept for CVE-2026-40217
  3. Attack activity. NOV 5, 2026
    Exploitation of CVE-2026-40217 reported (CIRCL sighting)

SOURCES

  1. [1] nuclei-templates: Nuclei scan template: LiteLLM < 1.25.0 - Remote Code Execution, NOV 7
  2. [2] CIRCL Vulnerability-Lookup sightings: Exploitation of CVE-2026-40217 reported (CIRCL sighting), NOV 5
  3. [3] PoC-in-GitHub: 1 public GitHub repository claims a proof of concept for CVE-2026-40217, MAY 19
  4. [4] CVE List V5 and CISA Vulnrichment: CISA Vulnrichment notes a public proof of concept for CVE-2026-40217, APR 10