CVE-2026-40217

• Litellm/Litellm

  cpe:2.3:a:litellm:litellm:*:*:*:*:*:*:*:*

  Range: <=2026-04-08

No patches discovered yet.

AI mechanics synthesis has not run for this CVE yet.

• github.com/advisories/GHSA-wxxx-gvqv-xp7pghsaADVISORY
• www.x41-dsec.de/lab/advisories/x41-2026-001-litellm/nvdThird Party AdvisoryExploitMitigation
• github.com/BerriAI/litellm/releases/tag/v1.83.10-stableghsa
• github.com/BerriAI/litellm/security/advisories/GHSA-wxxx-gvqv-xp7pghsa
• nvd.nist.gov/vuln/detail/CVE-2026-40217ghsa
• www.x41-dsec.de/lab/advisories/x41-2026-001-litellmghsa

• TeamPCP Weekly Analysis: 2026-W18 (2026-04-27 through 2026-05-03), (Mon, May 4th)
  SANS Internet Storm Center · May 4, 2026
• 4th May – Threat Intelligence Report
  Check Point Research · May 4, 2026
• The never-ending supply chain attacks worm into SAP npm packages, other dev tools
  The Register Security · Apr 30, 2026
• Great responsibility, without great power
  Cisco Talos Intelligence · Apr 30, 2026
• LiteLLM CVE-2026-42208 SQL Injection Exploited within 36 Hours of Disclosure
  The Hacker News · Apr 29, 2026
• Don't pay Vect a ransom - your data's likely already wiped out
  The Register Security · Apr 28, 2026
• Don't pay Vect a ransom - your data's likely already wiped out
  The Register Security · Apr 28, 2026
• VECT: Ransomware by design, Wiper by accident
  Check Point Research · Apr 28, 2026
• Ongoing supply-chain attack 'explicitly targeting' security, dev tools
  The Register Security · Apr 27, 2026
• Hypersonic Supply Chain Attacks: One Solution That Didn’t Need to Know the Payload
  SentinelOne Labs · Apr 22, 2026
• Frontier AI Reinforces the Future of Modern Cyber Defense
  SentinelOne Labs · Apr 16, 2026
• The Q1 vulnerability pulse
  Cisco Talos Intelligence · Apr 16, 2026
• The Good, the Bad and the Ugly in Cybersecurity – Week 14
  SentinelOne Labs · Apr 3, 2026
• 30th March – Threat Intelligence Report
  Check Point Research · Mar 30, 2026
• Risky Business #830 -- LiteLLM and security scanner supply chains compromised
  Risky Business · Mar 25, 2026
• CISA Adds One Known Exploited Vulnerability to Catalog
  CISA Alerts