{"record":{"id":"4b6e1f6bd21832f0","repo":"BerriAI/litellm","slug":"google-kms-requires-the-encrypted-secret-to-be-enc","errorCode":null,"errorMessage":"Google KMS requires the encrypted secret to be encoded in base64","messagePattern":"Google KMS requires the encrypted secret to be encoded in base64","errorType":"exception","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"litellm/secret_managers/secret_manager_handler.py","lineNumber":67,"sourceCode":"\n    if (\n        key_manager == KeyManagementSystem.AZURE_KEY_VAULT.value\n        or type(client).__module__ + \".\" + type(client).__name__ == \"azure.keyvault.secrets._client.SecretClient\"\n    ):  # support Azure Secret Client - from azure.keyvault.secrets import SecretClient\n        secret = client.get_secret(secret_name).value\n\n    elif (\n        key_manager == KeyManagementSystem.GOOGLE_KMS.value or client.__class__.__name__ == \"KeyManagementServiceClient\"\n    ):\n        encrypted_secret: Any = os.getenv(secret_name)\n        if encrypted_secret is None:\n            raise ValueError(\"Google KMS requires the encrypted secret to be in the environment!\")\n        b64_flag: Final = _is_base64(encrypted_secret)\n        if b64_flag is True:  # if passed in as encoded b64 string\n            encrypted_secret = base64.b64decode(encrypted_secret)\n            ciphertext: Final = encrypted_secret\n        else:\n            raise ValueError(\n                \"Google KMS requires the encrypted secret to be encoded in base64\"\n            )  # fix for this vulnerability https://huntr.com/bounties/ae623c2f-b64b-4245-9ed4-f13a0a5824ce\n        response = client.decrypt(\n            request={\n                \"name\": litellm._google_kms_resource_name,\n                \"ciphertext\": ciphertext,\n            }\n        )\n        secret = response.plaintext.decode(\"utf-8\")  # assumes the original value was encoded with utf-8\n\n    elif key_manager == KeyManagementSystem.AWS_KMS.value:\n        \"\"\"\n        Only check the tokens which start with 'aws_kms/'. This prevents latency impact caused by checking all keys.\n        \"\"\"\n        encrypted_value: Final = os.getenv(secret_name, None)\n        if encrypted_value is None:\n            raise Exception(f\"AWS KMS - Encrypted Value of Key={secret_name} is None\")\n        # Decode the base64 encoded ciphertext","sourceCodeStart":49,"sourceCodeEnd":85,"githubUrl":"https://github.com/BerriAI/litellm/blob/77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8/litellm/secret_managers/secret_manager_handler.py#L49-L85","documentation":"Google KMS branch guard: the environment-held encrypted secret failed base64 decoding, so it cannot be converted to the ciphertext bytes the KMS decrypt call requires. Hardening fix for a reported huntr vulnerability.","triggerScenarios":"Thrown at litellm/secret_managers/secret_manager_handler.py:67 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Base64-encode the KMS ciphertext before storing it in the environment variable (use the output of gcloud kms encrypt --ciphertext-file)."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8","analyzedAt":"2026-08-18T11:44:31.656Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}