From cee37b828d4d5fd99c3a616694f1108a78c94cf2 Mon Sep 17 00:00:00 2001 From: manusjs Date: Tue, 16 Jun 2026 22:06:53 +0000 Subject: [PATCH] fix(proxy): require admin role for credential management endpoints Add PROXY_ADMIN role authorization check to credential CRUD endpoints (POST /credentials, DELETE /credentials/{name}, PATCH /credentials/{name}). Previously these endpoints only verified authentication (valid API key) but did not check the caller's role, allowing any authenticated user to create, modify, or delete credentials. --- litellm/proxy/credential_endpoints/endpoints.py | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) diff --git a/litellm/proxy/credential_endpoints/endpoints.py b/litellm/proxy/credential_endpoints/endpoints.py index a716857111b..6477be23f10 100644 --- a/litellm/proxy/credential_endpoints/endpoints.py +++ b/litellm/proxy/credential_endpoints/endpoints.py @@ -10,7 +10,7 @@ import litellm from litellm._logging import verbose_proxy_logger from litellm.litellm_core_utils.credential_accessor import CredentialAccessor from litellm.litellm_core_utils.litellm_logging import _get_masked_values -from litellm.proxy._types import CommonProxyErrors, UserAPIKeyAuth +from litellm.proxy._types import CommonProxyErrors, LitellmUserRoles, UserAPIKeyAuth from litellm.proxy.auth.user_api_key_auth import user_api_key_auth from litellm.proxy.common_utils.encrypt_decrypt_utils import encrypt_value_helper from litellm.proxy.utils import handle_exception_on_proxy, jsonify_object @@ -60,6 +60,11 @@ async def create_credential( from litellm.proxy.proxy_server import llm_router, prisma_client try: + if user_api_key_dict.user_role != LitellmUserRoles.PROXY_ADMIN: + raise HTTPException( + status_code=403, + detail={"error": "Only proxy admins can manage credentials"}, + ) if prisma_client is None: raise HTTPException( status_code=500, @@ -241,6 +246,11 @@ async def delete_credential( from litellm.proxy.proxy_server import prisma_client try: + if user_api_key_dict.user_role != LitellmUserRoles.PROXY_ADMIN: + raise HTTPException( + status_code=403, + detail={"error": "Only proxy admins can manage credentials"}, + ) if prisma_client is None: raise HTTPException( status_code=500, @@ -320,6 +330,11 @@ async def update_credential( from litellm.proxy.proxy_server import prisma_client try: + if user_api_key_dict.user_role != LitellmUserRoles.PROXY_ADMIN: + raise HTTPException( + status_code=403, + detail={"error": "Only proxy admins can manage credentials"}, + ) if prisma_client is None: raise HTTPException( status_code=500,