CVE-2026-40217
LiteLLM through 2026-04-08 allows remote attackers to execute arbitrary code via bytecode rewriting at the /guardrails/test_custom_code URI.
Attention and evidence
Evidence confidence: Exploitation recorded
Hype components
Sources and documents
Score evolution
● Hype ● Reality
Earlier evidence-support scores are retained in history; this chart shows only the current priority definition.
━ Hype Score (Perceived) ━ Reality threat priority. Definition changes are not new attacks.
Public exploit evidence
Public exploit entries / repo candidates
Evidence context and dated references
Reality is general threat/review priority, combining observed exploitation, CVSS severity and fresh EPSS. Evidence confidence is separate. This is not calibrated risk, a victim count or an asset-specific assessment. A range reflects missing numeric inputs.
Evidence in context
- Confidence in exploitation evidence
- Exploitation recorded
- Priority basis
- Recorded exploitation; CVSS 8.8; EPSS 17.0%
- Attention, last 30 days
- 1 distinct story titles; 1 press documents; 1 publisher domains.
- Technical potential
- network access, low privileges, no user interaction.
- Observed activity
- An exploitation observation from a configured trusted reporter is present.
- Known scale
- Not quantified.
- Evidence confidence basis
- Trusted exploitation confirmation
Score evaluated: 2026-11-07 01:31:30.206196+00:00 · EPSS snapshot: 2026-11-05T12:03:04Z
Primary reports used by this score
- Google Threat Intelligence
Automatic extraction found a source statement about exploitation in attacks naming CVE-2026-40217.
Beyond exploiting traditional cloud infrastructure permissions, we have observed instances of threat actors targeting vulnerabilities specifically within LLM routing software to escalate privileges. In one
Scope: Only the cited paragraph and its stated conditions; not a prevalence estimate.
Attack observation: not dated; automatic extraction: primary-assertions-v1; not independently reviewed.