diff --git a/litellm/integrations/prometheus.py b/litellm/integrations/prometheus.py
index fb5fc253ae4..5e630ab2558 100644
--- a/litellm/integrations/prometheus.py
+++ b/litellm/integrations/prometheus.py
@@ -3429,6 +3429,14 @@ class PrometheusLogger(CustomLogger):
         from litellm._logging import verbose_proxy_logger
         from litellm.proxy.proxy_server import app
 
+        # Security warning for metrics endpoint (fixes #24530)
+        if not litellm.require_auth_for_metrics_endpoint:
+            verbose_proxy_logger.warning(
+                "⚠️  SECURITY WARNING: /metrics endpoint is exposed without authentication. "
+                "This may leak multi-tenant PII including team aliases, user emails, client IPs, and user agents. "
+                "Set 'require_auth_for_metrics_endpoint: true' in litellm_settings to enable authentication."
+            )
+
         # Create metrics ASGI app
         if "PROMETHEUS_MULTIPROC_DIR" in os.environ:
             from prometheus_client import CollectorRegistry, multiprocess
diff --git a/litellm/types/integrations/prometheus.py b/litellm/types/integrations/prometheus.py
index 0d1501664b9..33ce05525f0 100644
--- a/litellm/types/integrations/prometheus.py
+++ b/litellm/types/integrations/prometheus.py
@@ -334,13 +334,14 @@ class PrometheusMetricLabels:
         UserAPIKeyLabelNames.API_KEY_ALIAS.value,
         UserAPIKeyLabelNames.REQUESTED_MODEL.value,
         UserAPIKeyLabelNames.TEAM.value,
-        UserAPIKeyLabelNames.TEAM_ALIAS.value,
+        # Security: Removed PII labels (fixes #24530)
+        # UserAPIKeyLabelNames.TEAM_ALIAS.value,  # Contains company names and employee emails
         UserAPIKeyLabelNames.USER.value,
         UserAPIKeyLabelNames.STATUS_CODE.value,
-        UserAPIKeyLabelNames.USER_EMAIL.value,
+        # UserAPIKeyLabelNames.USER_EMAIL.value,  # Contains email addresses
         UserAPIKeyLabelNames.ROUTE.value,
-        UserAPIKeyLabelNames.CLIENT_IP.value,
-        UserAPIKeyLabelNames.USER_AGENT.value,
+        # UserAPIKeyLabelNames.CLIENT_IP.value,  # Contains client IP addresses
+        # UserAPIKeyLabelNames.USER_AGENT.value,  # Contains workflow IDs and infrastructure info
         UserAPIKeyLabelNames.MODEL_ID.value,
     ]