mirror of
https://github.com/BerriAI/litellm.git
synced 2026-09-13 23:11:40 +00:00
433aef58e5
GET /team/{team_id}/callback masked credential-bearing callback_vars as the
literal ***REDACTED***. No write path recognises that marker, so a caller that
cloned the response into POST /team/{team_id}/callback or POST /team/update
stored the marker itself as the credential. It is encrypted at rest like any
other secret, so the row looks legitimate while the team's logging silently
stops working.
Drop the credential keys from the response instead, so no marker exists for a
caller to echo back. The response is a partial config rather than a safe round
trip: the metadata write paths replace logging wholesale, so echoing it back
still drops the stored credential, it just cannot substitute a fabricated one.
Resolves LIT-5110
|
||
|---|---|---|
| .. | ||
| litellm-dashboard | ||
| Dockerfile | ||
| nginx.conf | ||