From d3d31dea85f46d99e99510cb4697d59f4ebb745f Mon Sep 17 00:00:00 2001
From: zhaog100 <zhaog100@users.noreply.github.com>
Date: Tue, 31 Mar 2026 22:06:15 -0700
Subject: [PATCH] =?UTF-8?q?=F0=9F=94=92=20Security:=20Remove=20PII=20label?=
 =?UTF-8?q?s=20from=20Prometheus=20metrics=20&=20add=20warning?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Phase 2: Sanitize PII labels
- Removed team_alias (contains company names and employee emails)
- Removed user_email (contains email addresses)
- Removed client_ip (contains client IP addresses)
- Removed user_agent (contains workflow IDs and infrastructure info)

Phase 3: Add startup warning
- Added security warning when /metrics is exposed without auth
- Warns about PII exposure risk
- Suggests enabling require_auth_for_metrics_endpoint

These changes complement Phase 1 (default auth) to provide defense in depth:
1. Auth by default prevents unauthorized access
2. Sanitized labels reduce PII exposure even if auth is disabled
3. Startup warning alerts operators to security risk
---
 litellm/integrations/prometheus.py       | 8 ++++++++
 litellm/types/integrations/prometheus.py | 9 +++++----
 2 files changed, 13 insertions(+), 4 deletions(-)

diff --git a/litellm/integrations/prometheus.py b/litellm/integrations/prometheus.py
index fb5fc253ae4..5e630ab2558 100644
--- a/litellm/integrations/prometheus.py
+++ b/litellm/integrations/prometheus.py
@@ -3429,6 +3429,14 @@ class PrometheusLogger(CustomLogger):
         from litellm._logging import verbose_proxy_logger
         from litellm.proxy.proxy_server import app
 
+        # Security warning for metrics endpoint (fixes #24530)
+        if not litellm.require_auth_for_metrics_endpoint:
+            verbose_proxy_logger.warning(
+                "⚠️  SECURITY WARNING: /metrics endpoint is exposed without authentication. "
+                "This may leak multi-tenant PII including team aliases, user emails, client IPs, and user agents. "
+                "Set 'require_auth_for_metrics_endpoint: true' in litellm_settings to enable authentication."
+            )
+
         # Create metrics ASGI app
         if "PROMETHEUS_MULTIPROC_DIR" in os.environ:
             from prometheus_client import CollectorRegistry, multiprocess
diff --git a/litellm/types/integrations/prometheus.py b/litellm/types/integrations/prometheus.py
index 0d1501664b9..33ce05525f0 100644
--- a/litellm/types/integrations/prometheus.py
+++ b/litellm/types/integrations/prometheus.py
@@ -334,13 +334,14 @@ class PrometheusMetricLabels:
         UserAPIKeyLabelNames.API_KEY_ALIAS.value,
         UserAPIKeyLabelNames.REQUESTED_MODEL.value,
         UserAPIKeyLabelNames.TEAM.value,
-        UserAPIKeyLabelNames.TEAM_ALIAS.value,
+        # Security: Removed PII labels (fixes #24530)
+        # UserAPIKeyLabelNames.TEAM_ALIAS.value,  # Contains company names and employee emails
         UserAPIKeyLabelNames.USER.value,
         UserAPIKeyLabelNames.STATUS_CODE.value,
-        UserAPIKeyLabelNames.USER_EMAIL.value,
+        # UserAPIKeyLabelNames.USER_EMAIL.value,  # Contains email addresses
         UserAPIKeyLabelNames.ROUTE.value,
-        UserAPIKeyLabelNames.CLIENT_IP.value,
-        UserAPIKeyLabelNames.USER_AGENT.value,
+        # UserAPIKeyLabelNames.CLIENT_IP.value,  # Contains client IP addresses
+        # UserAPIKeyLabelNames.USER_AGENT.value,  # Contains workflow IDs and infrastructure info
         UserAPIKeyLabelNames.MODEL_ID.value,
     ]