9 views
-/https://github.com/berriai/litellm/issues/30670
GitHub · issue

#30670 [Security]: virtual key leakage in logs when BudgetExceededError occurs

  • State: open
  • Author: @iavael
  • Labels: bug, proxy

### Check for existing issues

- [x] I have searched the existing issues and checked that my issue is not a duplicate.

### What happened?

When BudgetExceededError occurs, litellm writes an Request Logs entry with plaintext virtual key (Bearer sk-<etc>) in user_api_key field instead of key hash

### Steps to Reproduce

1. Еxceed budget 2. Make request to model and get BudgetExceededError 3. Observe virtual key in plaintext in "Key Hash" column of Logs section in UI

### Relevant log output

```shell Stacktrace:

BudgetExceededError: Budget has been exceeded! Team="[REDACTED]" Current cost: "[REDACTED]", Max budget: "[REDACTED]" File "litellm/proxy/auth/user_api_key_auth.py", line 2143, in user_api_key_auth await _run_centralized_common_checks( File "litellm/proxy/auth/user_api_key_auth.py", line 2004, in _run_centralized_common_checks _ = await common_checks( File "litellm/proxy/auth/auth_checks.py", line 626, in common_checks await _team_max_budget_check( File "litellm/proxy/auth/auth_checks.py", line 3736, in _team_max_budget_check raise litellm.BudgetExceededError( ```

### What part of LiteLLM is this about?

Proxy

### What LiteLLM version are you on …

GitHub resolver

Import GitHub neighbors on demand. Results are saved as system ingests.

Refresh page
vote history (1 events)
#0 of 0 · 31d18h22m11s ago — entered · #import:https:::github.com:berriai:litellm post #2471
The left issue is harder because it involves security-sensitive credential handling, tracing the failure path through authentication and logging, and validating that redaction remains correct across related error paths. The right issue appears comparatively localized to defensive parsing and error translation in one provider’s streaming transformation, with narrower regression testing.
discussed in #import:https:::github.com:berriai:litellm

ranked child groups

no voted pairs yet in this scope

cli
src
spread
search