From 7259d4f6b4e0dda6c4f3703f404a373a935cd0ce Mon Sep 17 00:00:00 2001 From: Ishaan Jaffer Date: Wed, 11 Mar 2026 19:30:43 -0700 Subject: [PATCH] fix: sanitize user_id/server_id in log to prevent log injection --- litellm/proxy/_experimental/mcp_server/rest_endpoints.py | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/litellm/proxy/_experimental/mcp_server/rest_endpoints.py b/litellm/proxy/_experimental/mcp_server/rest_endpoints.py index 4a4123ca1d5..faf6f80b280 100644 --- a/litellm/proxy/_experimental/mcp_server/rest_endpoints.py +++ b/litellm/proxy/_experimental/mcp_server/rest_endpoints.py @@ -101,9 +101,9 @@ if MCP_AVAILABLE: return {"Authorization": f"Bearer {cred['access_token']}"} except Exception: verbose_logger.debug( - "Failed to fetch OAuth credential for user %s / server %s", - user_id, - server_id, + "Failed to fetch OAuth credential for user %r / server %r", + str(user_id).replace("\n", "\\n").replace("\r", "\\r"), + str(server_id).replace("\n", "\\n").replace("\r", "\\r"), exc_info=True, ) return None