From 12c71ab407c033e2e9553085fe7d9bc0cc6d6c61 Mon Sep 17 00:00:00 2001 From: mateo Date: Tue, 15 Sep 2026 18:40:44 +0000 Subject: [PATCH] fix(proxy): block bulk user creation during the master key lockout Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> --- litellm/proxy/auth/master_key_policy.py | 2 +- tests/test_litellm/proxy/auth/test_master_key_policy.py | 2 ++ 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/litellm/proxy/auth/master_key_policy.py b/litellm/proxy/auth/master_key_policy.py index e9fece1c01e..f5a5100e8be 100644 --- a/litellm/proxy/auth/master_key_policy.py +++ b/litellm/proxy/auth/master_key_policy.py @@ -41,7 +41,7 @@ class _DeploymentMarker(TypedDict, total=False): _DEPLOYMENT_MARKERS: Final = TypeAdapter(list[_DeploymentMarker]) -_VIRTUAL_KEY_MINTING_ROUTES: Final = ("/user/new",) +_VIRTUAL_KEY_MINTING_ROUTES: Final = ("/user/new", "/management/v1/users/bulk") _ACCESS_CREDENTIAL_ROUTES: Final = ( "/credentials", diff --git a/tests/test_litellm/proxy/auth/test_master_key_policy.py b/tests/test_litellm/proxy/auth/test_master_key_policy.py index 112c52fd88d..2ccc8951a88 100644 --- a/tests/test_litellm/proxy/auth/test_master_key_policy.py +++ b/tests/test_litellm/proxy/auth/test_master_key_policy.py @@ -103,6 +103,7 @@ def test_insecure_master_key_warning_survives_redaction(): ("/key/service-account/generate", "POST", "manage_virtual_keys"), ("/key/block", "POST", "manage_virtual_keys"), ("/user/new", "POST", "manage_virtual_keys"), + ("/management/v1/users/bulk", "POST", "manage_virtual_keys"), ("/key/info", "GET", None), ("/user/info", "GET", None), ("/key/list", "GET", None), @@ -143,6 +144,7 @@ def test_master_key_lockout_action_none_when_key_secure(route, method): ("/key/generate", "POST"), ("/key/abc/regenerate", "POST"), ("/user/new", "POST"), + ("/management/v1/users/bulk", "POST"), ], ) @pytest.mark.parametrize("reason", ["example_key", "missing"])