fix(pass-through): clean stale routes from auth allowlist

[silencedoctor]

TLDR

Problem this solves:

• Authenticated pass-through reloads can leave stale allowlist paths
• Removed or unauthenticated endpoints can retain obsolete access paths

How it solves it:

• Reconcile prior and current authenticated endpoint paths on reload
• Preserve live, shared, idless, and built-in OpenAI routes

Relevant issues

Fixes #26081

Linear ticket

Pre-Submission checklist

• I have added meaningful tests
• My PR passes all CI/CD checks
• My PR scope is isolated to stale pass-through auth paths
• I have received a Greptile Confidence Score of at least 4/5

Delays in PR merge?

If review is delayed, please use the LiteLLM Slack #pr-review channel

Screenshots / Proof of Fix

No end-to-end proof was captured for this internal reload registry change

Type

Bug Fix

Changes

The registry bounding fix from the original PR is already present in the current base

This PR now removes dynamic auth allowlist paths that belonged to authenticated endpoints in the previous reload but are absent from the current configuration

Cleanup preserves paths still used by another endpoint, paths retained by idless reloads, and built-in OpenAI routes. It also handles endpoints whose authentication changes from enabled to disabled

Validation

The pass-through and auth test suites completed with 135 passing tests and 1 skipped test

Final Attestation

• The tests cover removed, shared, idless, auth-disabled, and built-in route cases

[veria-ai]

Medium: Stale routes left in authorization allowlist after cleanup

This PR addresses unbounded growth in _registered_pass_through_routes by using dict.pop() instead of remove_endpoint_routes(). However, the old method also cleaned up stale paths from LiteLLMRoutes.openai_routes, which is an authorization allowlist checked during route access control. The new code skips that cleanup, so stale pass-through paths accumulate in the allowlist indefinitely.

In practice, a removed route would 404 at the framework level since the FastAPI handler isn't re-registered, limiting exploitability. But the openai_routes list is consulted for budget enforcement, OAuth2 routing, and admin-viewer access checks, so a growing stale list could have subtle authorization side effects.

[greptile-apps]

Greptile Summary

This one-line fix replaces a broken remove_endpoint_routes(endpoint_key) call in initialize_pass_through_endpoints with _registered_pass_through_routes.pop(endpoint_key, None). The root cause is clear: the old helper compared a full composite key (e.g. {uuid}:exact:/path:GET,POST) against value[\"endpoint_id\"] (UUID only), so stale entries for DB-sourced endpoints without an id field were never removed, causing unbounded registry growth and eventual CPU saturation. The fix is correct and well-scoped — the two other call sites of remove_endpoint_routes (explicit delete/update paths) are intentionally left unchanged.

Confidence Score: 5/5

Safe to merge; the fix is minimal, targeted, and does not affect any other code path.

The single changed line correctly resolves the root cause with no side effects. The only finding is P2 (test quality — first two unit tests verify dict built-in behavior rather than the production code path), which does not affect correctness or reliability.

No files require special attention.

Important Files Changed

Filename	Overview
litellm/proxy/pass_through_endpoints/pass_through_endpoints.py	Replaces the broken remove_endpoint_routes(endpoint_key) call (which never matched because a composite key was compared against UUID-only values) with a direct O(1) dict.pop(). The fix correctly skips LiteLLMRoutes.openai_routes cleanup since those entries are path-keyed (not UUID-keyed) and remain valid across UUID changes.
tests/test_litellm/proxy/pass_through_endpoints/test_pass_through_endpoints.py	Adds TestRemoveStaleEndpointRoute with 3 tests; the core regression test (cycle simulation) is valuable, but the other two tests exercise dict built-in behavior rather than production logic.

_{Reviews (1): Last reviewed commit: "fix(pass-through): pop stale route key d..." | Re-trigger Greptile}

[codspeed-hq]

Congrats! CodSpeed is installed 🎉

🆕 16 new benchmarks were detected.

You will start to see performance impacts in the reports once the benchmarks are run from your default branch.

Detected benchmarks

• test_cost_per_token_openai: 557.6 µs
• test_get_llm_provider_azure: 145.6 µs
• test_get_llm_provider_anthropic: 141.6 µs
• test_cost_per_token_anthropic: 559.5 µs
• test_get_llm_provider_openai: 138.2 µs
• test_token_counter_long_content: 1.7 ms
• test_token_counter_with_tools: 413.2 µs
• test_get_llm_provider_with_prefix: 136.9 µs
• test_token_counter_multi_turn: 564.2 µs
• test_token_counter_raw_text: 183.2 µs
• test_get_model_cost_key_case_insensitive: 81.9 µs
• test_token_counter_simple_message: 234.3 µs
• test_get_model_cost_key_exact_match: 79.8 µs
• test_get_model_info_openai: 80.5 µs
• test_get_model_info_with_provider: 79.7 µs
• test_get_model_info_anthropic: 80.2 µs

---

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[silencedoctor]

Rebased onto litellm_internal_staging and retargeted the PR base accordingly, per the Release Cycle doc — external contributions now go to litellm_internal_staging (the active default branch); main only accepts promote-from-staging PRs.

One small conflict in tests/test_litellm/proxy/pass_through_endpoints/test_pass_through_endpoints.py (upstream and this PR both appended a test to the end of the file); resolved by keeping both unrelated tests. The production fix in pass_through_endpoints.py auto-merged cleanly.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you all sign our Contributor License Agreement before we can accept your contribution.
8 out of 9 committers have signed the CLA.

✅ tin-berri
✅ yuneng-berri
✅ yucheng-berri
✅ mubashir1osmani
✅ shivamrawat1
✅ silencedoctor
✅ ryan-crabbe-berri
✅ mateo-berri
❌ devin-ai-integration[bot]
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[silencedoctor]

Addressed Veria Medium + Greptile P2: extracted _remove_stale_pass_through_routes helper that pops the registry entry and removes the route's path (plus wildcard for subpath routes) from LiteLLMRoutes.openai_routes.value — mirroring what the old remove_endpoint_routes did, so the authorization allowlist no longer grows unboundedly across reload cycles. Added a direct test driving the helper that asserts both the registry and allowlist shrink. cc @greptileai

[greptile-apps]

The fix looks good. The _remove_stale_pass_through_routes helper correctly addresses both concerns:

1. Veria Medium (allowlist growth): Properly handled — the helper removes the path and wildcard from LiteLLMRoutes.openai_routes.value before popping the registry entry.

2. Greptile P2 (test coverage): test_helper_also_clears_openai_routes_allowlist now calls the actual production function and asserts both the registry and allowlist shrink. That's meaningfully better coverage than the first two tests.

One minor nit: the verbose_proxy_logger.debug call sits outside the if route_info is not None: block, so it fires even when route_info is None (key already absent from the registry). That could produce misleading log lines claiming a route was removed when nothing was actually there.

        route_info = _registered_pass_through_routes.pop(endpoint_key, None)
        if route_info is not None:
            path = route_info.get("path")
            if isinstance(path, str):
                openai_routes = LiteLLMRoutes.openai_routes.value
                if path in openai_routes:
                    openai_routes.remove(path)
                if route_info.get("type") == "subpath":
                    wildcard_path = path.rstrip("/") + "/*"
                    if wildcard_path in openai_routes:
                        openai_routes.remove(wildcard_path)
            verbose_proxy_logger.debug(
                "Removed stale pass-through route from registry: %s",
                endpoint_key,
            )

Otherwise the change is correct and the core regression test (test_registry_does_not_grow_across_reload_cycles) combined with the new allowlist test gives solid confidence.

[veria-ai]

PR overview

All previously flagged issues have been addressed. No open security concerns remain on this pull request.

Security review

No open security issues remain on this pull request.

Fixed/addressed: 2 · PR risk: 0/10