fix: backport #27878 to litellm_1.84.0rc2

[yuneng-berri]

Backport of #27878 (squash commit 8bbc61e03c) onto litellm_1.84.0rc2.

Conflict resolution

Three conflicts arose because the squash diff was rebased on staging content that is not on rc2. Three subagents independently verified each resolution.

1. .github/workflows/test-unit-proxy-db.yml

   • Staging's proxy-runtime shard lists test_request_size_limit_middleware.py (added by Fix early proxy request size enforcement #27311, not on rc2). PR fix: harden /key/update authorization checks #27878 itself only adds test_multipart_bypass_repro.py.
   • Resolution: add only test_multipart_bypass_repro.py; drop the test_request_size_limit_middleware.py line (its source file does not exist on rc2).

2. tests/test_litellm/proxy/rag_endpoints/test_rag_endpoints.py

   • Staging's file already contained class TestRagIngestSSRFBlocked (from Worktree fix mcp byok oauth #27892). PR fix: harden /key/update authorization checks #27878 only adds test_rag_ingest_blocks_clientside_credentials.
   • Resolution: add only test_rag_ingest_blocks_clientside_credentials; TestRagIngestSSRFBlocked is part of the separate Worktree fix mcp byok oauth #27892 backport.

3. tests/test_litellm/proxy/test_proxy_server.py

   • Staging's file already contained test_realtime_websocket_route_aliases_registered (from 5d7b7e7e37, not on rc2). PR fix: harden /key/update authorization checks #27878 only adds the LitellmUserRoles, UserAPIKeyAuth import and the TestTransformRequestBannedParams class.
   • Resolution: add only the import and TestTransformRequestBannedParams; drop test_realtime_websocket_route_aliases_registered.

Test plan

• uv run pytest tests/test_litellm/proxy/management_endpoints/test_key_management_endpoints.py::TestKeyOwnerPrivilegeEscalation -v
• uv run pytest tests/test_litellm/proxy/rag_endpoints/test_rag_endpoints.py -v
• uv run pytest tests/test_litellm/proxy/test_proxy_server.py::TestTransformRequestBannedParams -v
• uv run pytest tests/proxy_unit_tests/test_prompt_test_endpoint.py -v
• uv run pytest tests/proxy_unit_tests/test_multipart_bypass_repro.py -v
• make test-unit passes on the rc2 base

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you all sign our Contributor License Agreement before we can accept your contribution.
1 out of 2 committers have signed the CLA.

✅ yuneng-berri
❌ krrish-berri-2
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[codecov]

Codecov Report

❌ Patch coverage is 71.42857% with 6 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
litellm/proxy/auth/auth_utils.py	72.72%	3 Missing ⚠️
litellm/proxy/prompts/prompt_endpoints.py	25.00%	3 Missing ⚠️

📢 Thoughts on this report? Let us know!

[greptile-apps]

Greptile Summary

This backport of #27878 onto litellm_1.84.0rc2 closes several SSRF / credential-exfiltration attack surfaces across the proxy: the multipart JSON-string bypass in is_request_body_safe, the provider-name substring route-bypass in is_llm_api_route, client-supplied credential fields in the RAG ingest endpoint, and unguarded api_base passthrough in /utils/transform_request and /prompts/test. Authorization for /key/update and /user/update is also hardened against privilege escalation.

• Security fixes: route_checks.py changes the pass-through route check from substring (in) to exact/prefix match, preventing any admin-only path whose URL contains a provider name from bypassing the admin gate; rag_endpoints/endpoints.py rejects a block-list of credential fields in ingest_options.vector_store; proxy_server.py and prompt_endpoints.py both call is_request_body_safe before forwarding requests.
• Auth hardening: key_management_endpoints.py replaces the old is_key_owner (user_id-only) bypass with caller_is_creator (requires both created_by == caller AND user_id == caller); internal_user_endpoints.py extracts /user/update authorization into _check_user_update_authz, applied after the DB lookup.
• Infrastructure: migration SQL gains IF NOT EXISTS for idempotency; the ASGI-scope-based rewrite of get_request_route removes reliance on request.base_url.

Confidence Score: 4/5

Safe to merge with minor caveats — the security fixes are correct and well-tested; only the created_by null case and one weakened test assertion warrant follow-up

All five SSRF/credential-exfil vectors are correctly closed and each has a matching regression test. The caller_is_creator logic is sound for keys created by the owning user, but silently falls through to the admin check for keys whose created_by is NULL (legacy or master-key-created records), which could break self-service key management for a small set of users without warning. The test assertion relaxation in test_validate_max_budget reduces regression detection without any benefit.

litellm/proxy/management_endpoints/key_management_endpoints.py — the caller_is_creator NULL handling; tests/test_litellm/proxy/management_endpoints/test_key_management_endpoints.py — the weakened _validate_max_budget assertion

Important Files Changed

Filename	Overview
litellm/proxy/auth/auth_utils.py	Rewrites get_request_route to read directly from ASGI scope instead of request.base_url; contains one dead isinstance guard after a str() cast
litellm/proxy/auth/route_checks.py	Fixes CVE-class route-bypass: changes pass-through route matching from substring in to exact/prefix check, preventing provider-name-in-path admin-gate bypass
litellm/proxy/management_endpoints/key_management_endpoints.py	Tightens key-update auth by requiring both created_by and user_id to match the caller; keys with NULL created_by lose the self-service bypass silently
litellm/proxy/management_endpoints/internal_user_endpoints.py	Extracts /user/update authorization logic into _check_user_update_authz; logic is equivalent to what was inline before, now applied after the DB lookup
litellm/proxy/rag_endpoints/endpoints.py	Adds block-list for client-supplied credential fields in ingest_options.vector_store, closing an SSRF / credential-exfiltration vector via google-auth identity_pool
litellm/proxy/proxy_server.py	Adds is_request_body_safe guard to /utils/transform_request, preventing banned params from reaching SDK credential resolution
litellm/proxy/prompts/prompt_endpoints.py	Adds is_request_body_safe check to /prompts/test, blocking SSRF via dotprompt YAML api_base frontmatter
litellm-proxy-extras/litellm_proxy_extras/migrations/20260421135425_add_team_membership_total_spend/migration.sql	Adds IF NOT EXISTS to the ALTER TABLE for total_spend, making the migration idempotent
tests/proxy_unit_tests/test_multipart_bypass_repro.py	New unit tests verifying that banned params embedded inside a JSON-string litellm_embedding_config are caught by is_request_body_safe
tests/test_litellm/proxy/management_endpoints/test_key_management_endpoints.py	Adds comprehensive privilege-escalation tests; one existing assertion weakened from exact error string to "negative" without a matching implementation change
tests/test_litellm/proxy/auth/test_route_checks.py	New parametrized tests covering the route-bypass fix for both the attack paths and the legitimate pass-through routes
tests/test_litellm/proxy/rag_endpoints/test_rag_endpoints.py	Adds parametrized test confirming all blocked credential fields in ingest_options.vector_store return HTTP 400

_{Reviews (1): Last reviewed commit: "Merge remote-tracking branch 'origin/lit..." | Re-trigger Greptile}

[greptile-apps]

Weakened test assertion without matching implementation change

The assertion was loosened from "max_budget cannot be negative" to "negative", but _validate_max_budget still emits the full message "max_budget cannot be negative. Received: {value}". The stronger assertion would still pass, so the relaxation serves no purpose and reduces regression protection — any error containing "negative" (e.g., a new "soft_budget cannot be negative" path leaking through) would incorrectly satisfy this check.

Rule Used: What: Flag any modifications to existing tests and... (source)

[greptile-apps]

Dead type-guard after str() conversion

raw_path is assigned with str(scope.get(...)), so it is always a str. The subsequent if not isinstance(raw_path, str) guard is unreachable and misleads readers into thinking the value could be a non-string at that point.

Suggested change

	if not isinstance(scope, dict):
	return str(request.url.path)
	raw_path: str = str(scope.get("path", request.url.path))
	root_path: str = str(scope.get("app_root_path", scope.get("root_path", "")))
	if not isinstance(raw_path, str):
	raw_path: str = str(scope.get("path", request.url.path))
	root_path: str = str(scope.get("app_root_path", scope.get("root_path", "")))
	# Only strip root_path when it is a meaningful prefix (not bare "/").

[greptile-apps]

caller_is_creator silently fails when created_by is NULL on legacy keys

The new bypass condition requires both created_by == caller and user_id == caller. Keys stored with created_by = NULL (possible for keys created before the field was reliably populated, or created via a master-key path where user_api_key_dict.user_id is None) will never satisfy this condition. A user whose user_id is on the key but whose created_by is NULL will now be directed to _check_key_admin_access instead of the former is_key_owner shortcut, potentially losing self-service update capability on their own personal keys. Consider adding a fallback: treat created_by = NULL AND user_id == caller the same as the creator case to preserve backwards compatibility for legacy keys.