fix(key_generate): harden GHSA-q775 session-token exemption against default_key_generate_params (1.88 rc)

[mateo-berri]

What & why

Follow-up to the merged #29637 (which backported #29612 onto patch/v1.88.0-rc.1). Closes a niche but real ceiling-bypass that #29612 introduced.

#29612 added a UI/CLI session-token exemption to the GHSA-q775 delegated-authority budget ceiling, but it evaluated data.team_id after the default_key_generate_params defaults loop can inject one. On an install that sets default_key_generate_params.team_id, a session token requesting a personal key (no explicit team_id) would have data.team_id auto-filled, flipping is_ui_session_team_key on and skipping the ceiling — the exact escalation GHSA-q775 closed.

Fix

• Capture _requested_team_id = data.team_id before the defaults loop (mirroring the existing pre-defaults capture of _requested_max_budget) and key the exemption off it.
• Add a regression test (...default_team_id_personal_key_still_capped) that fails on the pre-fix code and passes after.

The same hardening is applied to the other release lines (#29635 / 1.86.5, #29636 / 1.87.2) and to the upstream integration branch.

Type

Bug Fix

Pre-Submission checklist

• Adds a regression test
• Scope limited to the security hardening + its test

[greptile-apps]

Greptile Summary

This PR hardens the GHSA-q775 session-token exemption against default_key_generate_params injection by capturing _requested_team_id = data.team_id before the defaults loop runs, mirroring the existing _requested_max_budget pattern from the original fix.

• key_management_endpoints.py: Adds a pre-defaults capture of data.team_id into _requested_team_id and keys is_ui_session_team_key off it — so a personal-key request whose team_id was auto-filled by config defaults cannot accidentally gain the team-key exemption and bypass the budget ceiling.
• test_key_management_endpoints.py: Adds a targeted regression test (test_ghsa_q775_ui_session_token_default_team_id_personal_key_still_capped) that patches litellm.default_key_generate_params with a team_id, confirms the ceiling still fires, and would fail against the pre-fix code.

Confidence Score: 5/5

Safe to merge — the change is a two-line pre-defaults capture that closes a narrow escalation path, and the regression test correctly exercises the exact bypass scenario.

The production change is a single new variable capture placed precisely before the defaults loop, mirroring an identical pattern already present for _requested_max_budget. The logic is sound: a None pre-defaults team_id stays None in _requested_team_id even after the defaults loop fills data.team_id, so the team-key exemption cannot fire for personal-key requests. The regression test patches litellm.default_key_generate_params at the right import target, sets data.team_id to None, and asserts the 400 ceiling response — it would fail against the pre-fix code. No existing tests are weakened and no unrelated behavior is touched.

No files require special attention.

Important Files Changed

Filename	Overview
litellm/proxy/management_endpoints/key_management_endpoints.py	Adds pre-defaults capture of _requested_team_id and uses it in the is_ui_session_team_key guard — correct, minimal, and consistent with the existing _requested_max_budget pattern.
tests/test_litellm/proxy/management_endpoints/test_key_management_endpoints.py	Adds a new regression test that accurately simulates a default_key_generate_params.team_id injection and verifies the budget ceiling is still enforced; test is mock-only, no real network calls.

_{Reviews (1): Last reviewed commit: "fix(key_generate): harden GHSA-q775 sess..." | Re-trigger Greptile}

[codecov]

Codecov Report

❌ Patch coverage is 0% with 1 line in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
...y/management_endpoints/key_management_endpoints.py	0.00%	1 Missing ⚠️

📢 Thoughts on this report? Let us know!