6 views
-/https://github.com/berriai/litellm/issues/33323
GitHub · issue

#33323 [Bug]: max_budget_limiter ignores team-key policy and fails open on spend lookup errors

  • State: open
  • Author: @emerzon
  • Labels: proxy

### Check for existing issues

- [x] I have searched the existing issues and checked that my issue is not a duplicate

### What happened?

The pre-call [`_PROXY_MaxBudgetLimiter`](https://github.com/BerriAI/litellm/blob/65ca095d4d15a82372e53a547a2390a69f7e1797/litellm/proxy/hooks/max_budget_limiter.py#L13-L82) does not enforce the same user-budget policy as the main auth and reservation paths on current `litellm_internal_staging` at commit `65ca095d4d15a82372e53a547a2390a69f7e1797`

There are two independent problems in this hook

First, every request with a non-null `team_id` returns before reading user spend

```python if user_api_key_dict.team_id is not None: return ```

The comment says this matches the team-key exemption, but `common_checks` and budget reservation skip the user budget only when `general_settings.skip_user_budget_on_team_key is True`

With the default policy, user budgets should still apply to team keys

Second, the hook catches every non-`HTTPException`, logs it, and returns normally

```python except Exception as e: verbose_logger.exception(...) ```

A Redis/cache/runtime error from `get_current_spend` therefore makes this enforcement layer disappear …

GitHub resolver

Import GitHub neighbors on demand. Results are saved as system ingests.

Refresh page
vote history (2 events)
#0 of 0 · 31d18h23m54s ago — entered · #import:https:::github.com:berriai:litellm post #2547
33323 requires reconciling policy semantics across authorization and reservation flows, deciding safe behavior for datastore failures, and adding regression coverage for enforcement and failure modes; 34420 is a narrower provider-translation conditional fix with focused tests.
#0 of 0 · 31d18h19m48s ago — current · #import:https:::github.com:berriai:litellm post #2617
Issue 35136 is harder because it requires coordinated instrumentation across several asynchronous workflows, metric schema and label design, exporter integration, and broad validation. Issue 33323 is primarily a localized policy/control-flow correction with focused regression tests, though its failure semantics warrant careful security review.
discussed in #import:https:::github.com:berriai:litellm

ranked child groups

no voted pairs yet in this scope

cli
src
spread
search