From 7d7e33c5ad25eabe5c57049f9137e85a4b621a82 Mon Sep 17 00:00:00 2001
From: Ryan Crabbe <rcrabbe@berkeley.edu>
Date: Sat, 28 Feb 2026 17:14:08 -0800
Subject: [PATCH] Only persist Hashicorp Vault config to DB after successful
 init, roll back env vars on failure

---
 .../config_override_endpoints.py              | 42 +++++++++----------
 litellm/proxy/proxy_server.py                 | 11 +++--
 2 files changed, 28 insertions(+), 25 deletions(-)

diff --git a/litellm/proxy/management_endpoints/config_override_endpoints.py b/litellm/proxy/management_endpoints/config_override_endpoints.py
index 85509688e95..e5532e3b03a 100644
--- a/litellm/proxy/management_endpoints/config_override_endpoints.py
+++ b/litellm/proxy/management_endpoints/config_override_endpoints.py
@@ -183,10 +183,27 @@ async def update_hashicorp_vault_config(
             },
         )
 
-    # Encrypt sensitive fields before storing in DB
-    encrypted_data = _encrypt_sensitive_fields(config_data, HASHICORP_SENSITIVE_FIELDS)
+    # Set env vars and verify the secret manager can initialize before persisting
+    _set_env_vars(config_data)
 
-    # Upsert to DB first — only mutate env vars after DB write succeeds
+    try:
+        proxy_config.initialize_secret_manager(
+            key_management_system="hashicorp_vault"
+        )
+    except Exception as e:
+        _set_env_vars({})
+        verbose_proxy_logger.exception(
+            "Error reinitializing Hashicorp Vault secret manager: %s", str(e)
+        )
+        raise HTTPException(
+            status_code=500,
+            detail={
+                "error": f"Failed to initialize secret manager: {str(e)}"
+            },
+        )
+
+    # Only persist to DB after successful init
+    encrypted_data = _encrypt_sensitive_fields(config_data, HASHICORP_SENSITIVE_FIELDS)
     await prisma_client.db.litellm_configoverrides.upsert(
         where={"config_type": "hashicorp_vault"},
         data={
@@ -200,25 +217,6 @@ async def update_hashicorp_vault_config(
         },
     )
 
-    # Set environment variables after DB write succeeds
-    _set_env_vars(config_data)
-
-    # Reinitialize the secret manager on this pod
-    try:
-        proxy_config.initialize_secret_manager(
-            key_management_system="hashicorp_vault"
-        )
-    except Exception as e:
-        verbose_proxy_logger.exception(
-            "Error reinitializing Hashicorp Vault secret manager: %s", str(e)
-        )
-        raise HTTPException(
-            status_code=500,
-            detail={
-                "error": f"Config saved but failed to initialize secret manager: {str(e)}"
-            },
-        )
-
     return {
         "message": "Hashicorp Vault configuration updated successfully",
         "status": "success",
diff --git a/litellm/proxy/proxy_server.py b/litellm/proxy/proxy_server.py
index b9c00088e9d..05d7e892941 100644
--- a/litellm/proxy/proxy_server.py
+++ b/litellm/proxy/proxy_server.py
@@ -4581,9 +4581,14 @@ class ProxyConfig:
             _set_env_vars(decrypted_data)
 
             # Reinitialize the secret manager
-            self.initialize_secret_manager(
-                key_management_system="hashicorp_vault"
-            )
+            try:
+                self.initialize_secret_manager(
+                    key_management_system="hashicorp_vault"
+                )
+            except Exception:
+                # Roll back env vars so the broken config doesn't affect secret lookups
+                _set_env_vars({})
+                raise
 
             verbose_proxy_logger.debug(
                 "Hashicorp Vault config override loaded from DB"