From a136e692109cda2088b838530606efd8ed5d978e Mon Sep 17 00:00:00 2001
From: user <70670632+stuxf@users.noreply.github.com>
Date: Sat, 30 May 2026 22:08:44 +0000
Subject: [PATCH] chore(proxy): block database_args from /config/field/info

database_args holds DynamoDBArgs, which includes aws_web_identity_token; a
read-only admin could read it through the field-info endpoint. This completes
the denylist of secret-bearing general_settings fields (master_key,
database_url, alert_to_webhook_url, pass_through_endpoints, database_args).
---
 litellm/proxy/proxy_server.py                             | 1 +
 .../proxy/test_readonly_admin_secret_redaction.py         | 8 +++++++-
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/litellm/proxy/proxy_server.py b/litellm/proxy/proxy_server.py
index 3b7e93a4087..972b21dc24a 100644
--- a/litellm/proxy/proxy_server.py
+++ b/litellm/proxy/proxy_server.py
@@ -14262,6 +14262,7 @@ _SECRET_CONFIG_GENERAL_SETTINGS_FIELDS = {
     "database_url",
     "alert_to_webhook_url",
     "pass_through_endpoints",
+    "database_args",  # DynamoDBArgs carries aws_web_identity_token
 }
 
 
diff --git a/tests/test_litellm/proxy/test_readonly_admin_secret_redaction.py b/tests/test_litellm/proxy/test_readonly_admin_secret_redaction.py
index f5241c95f0d..19eef974a79 100644
--- a/tests/test_litellm/proxy/test_readonly_admin_secret_redaction.py
+++ b/tests/test_litellm/proxy/test_readonly_admin_secret_redaction.py
@@ -173,7 +173,13 @@ async def test_pass_through_get_masks_headers_for_non_admin_only():
 @pytest.mark.asyncio
 @pytest.mark.parametrize(
     "field_name",
-    ["master_key", "database_url", "alert_to_webhook_url", "pass_through_endpoints"],
+    [
+        "master_key",
+        "database_url",
+        "alert_to_webhook_url",
+        "pass_through_endpoints",
+        "database_args",
+    ],
 )
 async def test_config_field_info_blocks_secret_fields(field_name):
     from litellm.proxy.proxy_server import get_config_general_settings