8 views
-/https://github.com/berriai/litellm/issues/35529
GitHub · issue

#35529 [Security]: End-user budget checks fail open on database lookup errors

  • State: open
  • Author: @emerzon

### Summary

A database error while loading an end-user object is converted into `None`, which is indistinguishable from an end user that was not found. The centralized authorization path then omits the end-user budget check

### Current behavior

`get_end_user_object()` catches a broad `Exception` and returns `None`

The common-check construction only adds `_check_end_user_budget()` when an end-user object with a budget is available. When the lookup failed because the database was unavailable, the result is the same as the not-found case and no budget check runs

This is separate from failures while reading a spend counter. The `fail_closed_budget_enforcement` setting cannot restore a check that was removed because object lookup returned `None`

### Reproduction

Create an end-user row with a positive `max_budget`, then inject a repository failure:

~~~python from unittest.mock import AsyncMock, patch

with patch( "litellm.proxy.auth.auth_checks.EndUserRepository.table.find_unique", new=AsyncMock(side_effect=RuntimeError("database unavailable")), ): end_user = await get_end_user_object( end_user_id="existing-end-user", prisma_client=prisma_client, …

GitHub resolver

Import GitHub neighbors on demand. Results are saved as system ingests.

Refresh page
vote history (1 events)
#0 of 0 · 31d17h52m13s ago — entered · #import:https:::github.com:berriai:litellm post #3106
The left task requires changing security-sensitive authorization and failure semantics, preserving legitimate not-found behavior, auditing call paths, and adding regression coverage. The right task is a narrowly scoped catalog-data correction with limited implementation risk.
discussed in #import:https:::github.com:berriai:litellm

ranked child groups

no voted pairs yet in this scope

cli
src
spread
search