CVE-2026-40217

High8.8 Published on Apr 10, 2026

LiteLLM through 2026-04-08 allows remote attackers to execute arbitrary code via bytecode rewriting at the /guardrails/test_custom_code URI.

Early warning: exploitation observed

Exploitation observed since Jul 30, 2026
Not yet in the official CISA catalogue
First attack observed 110 days after disclosure
Confirmed by sensors, not only by reports

Source: VulnCheck KEV · Oct 25, 2026 Oct 23, 2026 Oct 22, 2026 Oct 7, 2026 Oct 2, 2026 Oct 1, 2026

CVSS score8.8 / 10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness type (CWE)CWE-420, CWE-94

Vendorslitellm

Affected products

Vendors	Product	Versions
litellm	litellm	<= 2026-04-08

Vulnerabilities

AgentForger: When a Phishing Link Is Enough to Create a Persistent AI Insider

A CSRF flaw in ChatGPT Workspace, AgentForger, allowed a phishing link to create a persistent AI insider, risking data theft and remote command execution.

Jul 24, 202623:03 4 min readRead

This product uses the NVD API but is not endorsed or certified by the NVD.

CVE database

Early warning: exploitation observed

Affected products

Related articles

AgentForger: When a Phishing Link Is Enough to Create a Persistent AI Insider