fix(proxy): improve input validation on management endpoints

[jaydns]

Relevant issues

Pre-Submission checklist

Please complete all items before asking a LiteLLM maintainer to review your PR

• I have Added testing in the tests/test_litellm/ directory, Adding at least 1 test is a hard requirement - see details
• My PR passes all unit tests on make test-unit
• My PR's scope is as isolated as possible, it only solves 1 specific problem
• I have requested a Greptile review by commenting @greptileai and received a Confidence Score of at least 4/5 before requesting a maintainer review

Delays in PR merge?

If you're seeing a delay in your PR being merged, ping the LiteLLM Team on Slack (#pr-review).

CI (LiteLLM team)

CI status guideline:

• 50-55 passing tests: main is stable with minor issues.
• 45-49 passing tests: acceptable but needs attention
• <= 40 passing tests: unstable; be careful with your merges and assess the risk.

• Branch creation CI run
  Link:

• CI run for the last commit
  Link:

• Merge / cherry-pick CI run
  Links:

Type

🆕 New Feature
🐛 Bug Fix
🧹 Refactoring
📖 Documentation
🚄 Infrastructure
✅ Test

Changes

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
litellm	Ready	Preview, Comment	Apr 9, 2026 9:17pm

[codspeed-hq]

Merging this PR will not alter performance

✅ 16 untouched benchmarks

---

_{Comparing jaydns:fix/proxy-input-validation (d910a95) with main (3a6db70)}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[greptile-apps]

Greptile Summary

This PR closes three distinct security gaps in the LiteLLM proxy: it sandboxes the Jinja2 environment used to render user-supplied dotprompt templates (ImmutableSandboxedEnvironment), blocks non-proxy-admin callers from setting allowed_routes on keys (which would bypass the role-based route gate), and validates that UI theme image URLs must be HTTP/HTTPS (preventing local-path reads via the unauthenticated /get_image endpoint). Tests are added for all three fixes and correctly use mocks with no real network calls.

Confidence Score: 4/5

Safe to merge pending review of the two P2 findings around org-admin role scope and the silent clear-via-empty-list edge case on key update.

All three security fixes are well-implemented and tested. The only remaining concerns are P2: the allowed_routes guard silently blocks org admins (potentially backward-incompatible per codebase rules) and the UpdateKeyRequest.allowed_routes = [] default means a non-admin update could zero out an admin-set allow-list without triggering the permission check. Neither is a critical breakage, but both warrant a decision before merging.

litellm/proxy/management_endpoints/key_management_endpoints.py — specifically the _check_allowed_routes_caller_permission role check and how UpdateKeyRequest's [] default interacts with the permission guard.

Vulnerabilities

• SSTI prevention (prompt_manager.py): Switching from Environment to ImmutableSandboxedEnvironment correctly blocks __class__/__mro__ traversal and mutation of caller objects in user-supplied templates.
• Privilege escalation via allowed_routes: Non-admin users could previously set arbitrary allowed_routes on a key, bypassing RouteChecks.non_proxy_admin_allowed_routes_check. The new _check_allowed_routes_caller_permission guard closes this gap on both key/generate and key/update paths.
• Path traversal via UI theme URLs: _validate_public_image_url rejects non-HTTP/HTTPS values (local paths, file://, ../../ traversal, javascript:) before they are persisted and later served via the unauthenticated /get_image endpoint.
• Residual concern: A non-admin update request that omits allowed_routes may silently clear an existing admin-set allow-list due to the [] default inherited from KeyRequestBase (see inline comment).

Important Files Changed

Filename	Overview
litellm/proxy/management_endpoints/key_management_endpoints.py	Adds _check_allowed_routes_caller_permission to block non-admins from setting allowed_routes on generate and update key paths; check is correctly placed in both flows; minor formatting-only changes elsewhere.
litellm/integrations/dotprompt/prompt_manager.py	Replaces jinja2.Environment with ImmutableSandboxedEnvironment to prevent SSTI when user-supplied templates are rendered via /prompts/test; no other logic changes.
litellm/proxy/ui_crud_endpoints/proxy_setting_endpoints.py	Adds _validate_public_image_url helper and applies it to both logo_url and favicon_url in update_ui_theme_settings, rejecting any non-HTTP/HTTPS value to prevent path traversal via the unauthenticated /get_image endpoint.
tests/test_litellm/proxy/management_endpoints/test_key_management_endpoints.py	Adds TestAllowedRoutesCallerPermission class (4 async tests), test_jinja_prompt_manager_is_sandboxed, and two _validate_public_image_url tests — all mock-only, no real network calls.

Sequence Diagram

sequenceDiagram
    participant Client
    participant generate_key_fn
    participant _check_allowed_routes_caller_permission
    participant _common_key_generation_helper

    Client->>generate_key_fn: POST /key/generate {allowed_routes: [...]}
    generate_key_fn->>_check_allowed_routes_caller_permission: allowed_routes, user_role
    alt user_role == PROXY_ADMIN
        _check_allowed_routes_caller_permission-->>generate_key_fn: OK
        generate_key_fn->>_common_key_generation_helper: proceed
        _common_key_generation_helper-->>Client: 200 key created
    else non-admin with non-empty allowed_routes
        _check_allowed_routes_caller_permission-->>generate_key_fn: raise HTTPException(403)
        generate_key_fn-->>Client: 403 Forbidden
    else allowed_routes is None or []
        _check_allowed_routes_caller_permission-->>generate_key_fn: return (no-op)
        generate_key_fn->>_common_key_generation_helper: proceed
        _common_key_generation_helper-->>Client: 200 key created
    end

Loading

_{Reviews (1): Last reviewed commit: "fix(proxy): improve input validation on ..." | Re-trigger Greptile}

[greptile-apps]

ORG_ADMIN role is implicitly blocked from setting allowed_routes

The check only permits PROXY_ADMIN. Org admins (LitellmUserRoles.ORG_ADMIN) who previously could set allowed_routes on keys they manage will now receive a 403. If org admins should retain this capability, the guard needs to include that role:

if user_api_key_dict.user_role in (
    LitellmUserRoles.PROXY_ADMIN.value,
    LitellmUserRoles.ORG_ADMIN.value,
):
    return

If restricting org admins is intentional, a comment explaining the reasoning would help avoid future confusion.

[greptile-apps]

Non-admin can silently clear existing allowed_routes via update

UpdateKeyRequest.allowed_routes inherits = [] from KeyRequestBase, so when a non-admin sends an update request that omits allowed_routes, data.allowed_routes is []. The if not allowed_routes: return guard passes, and the update proceeds — potentially writing [] over a previously-restricted allowed_routes set by an admin. If prepare_key_update_data includes fields that differ from None, a non-admin could inadvertently (or deliberately) wipe the allow-list.

Consider checking data.allowed_routes is None instead of truthiness to distinguish "caller did not set this field" from "caller explicitly set empty list", or explicitly exclude [] from the update payload if unchanged from the inherited default.

[Bakul2006]

Hey @jaydns Are you facing the same issues with Lint Check