From ab3cd5e96eaddc3f47386377a8daf37a7be13df9 Mon Sep 17 00:00:00 2001 From: Ishaan Jaff Date: Wed, 3 Sep 2025 18:28:11 -0700 Subject: [PATCH] fix memory_usage_in_mem_cache cache endpoint vulnerability (#14229) --- litellm/proxy/_types.py | 6 +++++- litellm/proxy/common_utils/debug_utils.py | 12 +++++++++--- 2 files changed, 14 insertions(+), 4 deletions(-) diff --git a/litellm/proxy/_types.py b/litellm/proxy/_types.py index 7206d3dcb0..0595c44d69 100644 --- a/litellm/proxy/_types.py +++ b/litellm/proxy/_types.py @@ -388,7 +388,11 @@ class LiteLLMRoutes(enum.Enum): ] # NOTE: ROUTES ONLY FOR MASTER KEY - only the Master Key should be able to Reset Spend - master_key_only_routes = ["/global/spend/reset"] + master_key_only_routes = [ + "/global/spend/reset", + "/memory-usage-in-mem-cache", + "/memory-usage-in-mem-cache-items", + ] key_management_routes = [ KeyManagementRoutes.KEY_GENERATE, diff --git a/litellm/proxy/common_utils/debug_utils.py b/litellm/proxy/common_utils/debug_utils.py index 8096d782de..16ab2cc805 100644 --- a/litellm/proxy/common_utils/debug_utils.py +++ b/litellm/proxy/common_utils/debug_utils.py @@ -5,10 +5,12 @@ import os import tracemalloc from collections import Counter -from fastapi import APIRouter +from fastapi import APIRouter, Depends from litellm import get_secret_str from litellm._logging import verbose_proxy_logger +from litellm.proxy._types import UserAPIKeyAuth +from litellm.proxy.auth.user_api_key_auth import user_api_key_auth router = APIRouter() @@ -84,7 +86,9 @@ if os.environ.get("LITELLM_PROFILE", "false").lower() == "true": @router.get("/memory-usage-in-mem-cache", include_in_schema=False) -async def memory_usage_in_mem_cache(): +async def memory_usage_in_mem_cache( + _: UserAPIKeyAuth = Depends(user_api_key_auth), +): # returns the size of all in-memory caches on the proxy server """ 1. user_api_key_cache @@ -121,7 +125,9 @@ async def memory_usage_in_mem_cache(): @router.get("/memory-usage-in-mem-cache-items", include_in_schema=False) -async def memory_usage_in_mem_cache_items(): +async def memory_usage_in_mem_cache_items( + _: UserAPIKeyAuth = Depends(user_api_key_auth), +): # returns the size of all in-memory caches on the proxy server """ 1. user_api_key_cache