CVE-2026-37004: LiteLLM unauth SSTI

Q: Is CVE-2026-37004 actively exploited?

No confirmed active exploitation of CVE-2026-37004 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-37004?

Upgrade LiteLLM past the vulnerable 1.82.4 line to the patched release that sandboxes or replaces the jinja2.Environment used for dotprompt rendering. Until patched, restrict or disable the /prompts/test endpoint at the network layer (firewall/WAF rule blocking external access, or require authenticated internal-only access) since it should never need to be internet-facing. Rotate any upstream provider API keys (OpenAI, Anthropic, etc.) stored in the LiteLLM proxy's environment if the instance has been internet-exposed on a vulnerable version. Add detection for anomalous outbound connections or command-execution artifacts (e.g., unexpected child processes) spawned by the LiteLLM proxy process, and review WAF/access logs for jinja2 SSTI indicators (`{{`, `__globals__`, `__init__`, `os.popen`) in requests to `/prompts/test`.

Q: What systems are affected by CVE-2026-37004?

This vulnerability affects the following AI/ML architecture patterns: LLM gateway / API proxy, model serving, agent frameworks, RAG pipelines.

Q: What is the CVSS score for CVE-2026-37004?

No CVSS score has been assigned yet.

CISO Take

LiteLLM, the widely used open-source LLM gateway that unifies API access across OpenAI, Anthropic, and dozens of other providers, contains an unauthenticated server-side template injection in its /prompts/test endpoint: a crafted dotprompt_content parameter is rendered through an unsandboxed jinja2.Environment, letting a remote attacker escape the template sandbox and execute arbitrary OS commands with no credentials required. No CVSS score or EPSS percentile has been assigned yet, and the flaw isn't in CISA KEV or covered by a known Nuclei template, but the combination of zero authentication and direct code execution on infrastructure that typically holds every upstream provider's API keys makes this a de facto critical regardless of scoring status. Because LiteLLM sits as a proxy in front of RAG pipelines, agent frameworks, and multi-provider model routing, a single compromised instance can leak the credentials for every downstream AI service it fronts and become a pivot point into the rest of the environment. Patch to the release beyond 1.82.4 that fixes the sandboxing issue, and until you've confirmed the patched version is deployed, take any internet-facing /prompts/test endpoint offline or place it behind network-level authentication immediately.

Sources: NVD ATLAS github.com yerangamage.com

What is the risk?

Unscored by CVSS/EPSS, but the technical profile is critical-class: no authentication, no privileges, no user interaction, and a direct path from a single HTTP parameter to arbitrary OS command execution via an unsandboxed jinja2 template engine. Absence from CISA KEV and lack of a public Nuclei template only reflect the CVE's recency (published 2026-08-27), not lower risk — a public write-up (yerangamage.com) already documents the exploitation path, which typically precedes weaponized scanning within days. Any internet-facing LiteLLM proxy running <=1.82.4 should be treated as an active RCE exposure until patched.

How does the attack unfold?

Initial Access

Attacker sends an unauthenticated POST request to the internet-facing /prompts/test endpoint with a crafted dotprompt_content parameter.

AML.T0049

Exploitation

The unsandboxed jinja2.Environment renders the payload, allowing the attacker to escape the template sandbox and execute arbitrary OS commands.

AML.T0050

Impact

Attacker gains OS-level access on the LiteLLM proxy host, harvesting upstream provider API keys and pivoting into connected LLM/agent infrastructure.

Initial Access

Attacker sends an unauthenticated POST request to the internet-facing /prompts/test endpoint with a crafted dotprompt_content parameter.

AML.T0049

Exploitation

The unsandboxed jinja2.Environment renders the payload, allowing the attacker to escape the template sandbox and execute arbitrary OS commands.

AML.T0050

Impact

Attacker gains OS-level access on the LiteLLM proxy host, harvesting upstream provider API keys and pivoting into connected LLM/agent infrastructure.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
LiteLLM	pip	—	No patch
57.0K OpenSSF 5.8 6 dependents Pushed 5d ago 48% patched ~47d to patch Full package profile →

Do you use LiteLLM? You're affected.

How severe is it?

CVSS 3.1

N/A

EPSS

N/A

Exploitation Status

No known exploitation

Sophistication

Moderate

What should I do?

1 step

Upgrade LiteLLM past the vulnerable 1.82.4 line to the patched release that sandboxes or replaces the jinja2.Environment used for dotprompt rendering. Until patched, restrict or disable the /prompts/test endpoint at the network layer (firewall/WAF rule blocking external access, or require authenticated internal-only access) since it should never need to be internet-facing. Rotate any upstream provider API keys (OpenAI, Anthropic, etc.) stored in the LiteLLM proxy's environment if the instance has been internet-exposed on a vulnerable version. Add detection for anomalous outbound connections or command-execution artifacts (e.g., unexpected child processes) spawned by the LiteLLM proxy process, and review WAF/access logs for jinja2 SSTI indicators ({{, __globals__, __init__, os.popen) in requests to /prompts/test.

How is it classified?

Code Execution Data Leakage Inference API AML.T0049 - Exploit Public-Facing Application AML.T0050 - Command and Scripting Interpreter AML.T0072 - Reverse Shell

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6 - AI system deployment

NIST AI RMF

MEASURE 2.7 - AI system security and resilience is evaluated and documented

Frequently Asked Questions

What is CVE-2026-37004?

LiteLLM, the widely used open-source LLM gateway that unifies API access across OpenAI, Anthropic, and dozens of other providers, contains an unauthenticated server-side template injection in its /prompts/test endpoint: a crafted dotprompt_content parameter is rendered through an unsandboxed jinja2.Environment, letting a remote attacker escape the template sandbox and execute arbitrary OS commands with no credentials required. No CVSS score or EPSS percentile has been assigned yet, and the flaw isn't in CISA KEV or covered by a known Nuclei template, but the combination of zero authentication and direct code execution on infrastructure that typically holds every upstream provider's API keys makes this a de facto critical regardless of scoring status. Because LiteLLM sits as a proxy in front of RAG pipelines, agent frameworks, and multi-provider model routing, a single compromised instance can leak the credentials for every downstream AI service it fronts and become a pivot point into the rest of the environment. Patch to the release beyond 1.82.4 that fixes the sandboxing issue, and until you've confirmed the patched version is deployed, take any internet-facing /prompts/test endpoint offline or place it behind network-level authentication immediately.

Is CVE-2026-37004 actively exploited?

No confirmed active exploitation of CVE-2026-37004 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-37004?

Upgrade LiteLLM past the vulnerable 1.82.4 line to the patched release that sandboxes or replaces the jinja2.Environment used for dotprompt rendering. Until patched, restrict or disable the /prompts/test endpoint at the network layer (firewall/WAF rule blocking external access, or require authenticated internal-only access) since it should never need to be internet-facing. Rotate any upstream provider API keys (OpenAI, Anthropic, etc.) stored in the LiteLLM proxy's environment if the instance has been internet-exposed on a vulnerable version. Add detection for anomalous outbound connections or command-execution artifacts (e.g., unexpected child processes) spawned by the LiteLLM proxy process, and review WAF/access logs for jinja2 SSTI indicators (`{{`, `__globals__`, `__init__`, `os.popen`) in requests to `/prompts/test`.

What systems are affected by CVE-2026-37004?

This vulnerability affects the following AI/ML architecture patterns: LLM gateway / API proxy, model serving, agent frameworks, RAG pipelines.

What is the CVSS score for CVE-2026-37004?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

LLM gateway / API proxymodel servingagent frameworksRAG pipelines

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

AML.T0050 Command and Scripting Interpreter

AML.T0072 Reverse Shell

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.6

NIST AI RMF: MEASURE 2.7

What are the technical details?

Original Advisory

BerriAI litellm <=1.82.4 is vulnerable to Server-Side Template Injection (SSTI), which allows unauthenticated remote attackers to execute arbitrary OS commands via a crafted dotprompt_content parameter in the /prompts/test endpoint due to use of an unsandboxed jinja2.Environment.

Exploitation Scenario

An unauthenticated attacker discovers an internet-facing LiteLLM proxy (via shodan-style scanning or targeted recon of an organization's AI stack) and sends a crafted POST request to /prompts/test with a dotprompt_content payload such as a jinja2 SSTI chain (`{{ self.__init__.__globals__.__builtins__.__import__('os').popen('id').read() }}`). Because the endpoint requires no authentication and renders the input through an unsandboxed jinja2.Environment, the payload breaks out of the templating sandbox and executes as an OS command on the proxy host. From there, the attacker reads environment variables to harvest upstream LLM provider API keys, pivots to any internal services reachable from the proxy, and can silently tamper with prompts/responses flowing through every application that relies on this LiteLLM instance.