{"record":{"id":"a86a9857c3956611","repo":"BerriAI/litellm","slug":"google-kms-requires-the-encrypted-secret-to-be-in","errorCode":null,"errorMessage":"Google KMS requires the encrypted secret to be in the environment!","messagePattern":"Google KMS requires the encrypted secret to be in the environment!","errorType":"exception","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"litellm/secret_managers/secret_manager_handler.py","lineNumber":61,"sourceCode":"\n    Raises:\n        ValueError: If the secret cannot be retrieved or required parameters are missing\n        Exception: For other errors during secret retrieval\n    \"\"\"\n    secret = None\n\n    if (\n        key_manager == KeyManagementSystem.AZURE_KEY_VAULT.value\n        or type(client).__module__ + \".\" + type(client).__name__ == \"azure.keyvault.secrets._client.SecretClient\"\n    ):  # support Azure Secret Client - from azure.keyvault.secrets import SecretClient\n        secret = client.get_secret(secret_name).value\n\n    elif (\n        key_manager == KeyManagementSystem.GOOGLE_KMS.value or client.__class__.__name__ == \"KeyManagementServiceClient\"\n    ):\n        encrypted_secret: Any = os.getenv(secret_name)\n        if encrypted_secret is None:\n            raise ValueError(\"Google KMS requires the encrypted secret to be in the environment!\")\n        b64_flag: Final = _is_base64(encrypted_secret)\n        if b64_flag is True:  # if passed in as encoded b64 string\n            encrypted_secret = base64.b64decode(encrypted_secret)\n            ciphertext: Final = encrypted_secret\n        else:\n            raise ValueError(\n                \"Google KMS requires the encrypted secret to be encoded in base64\"\n            )  # fix for this vulnerability https://huntr.com/bounties/ae623c2f-b64b-4245-9ed4-f13a0a5824ce\n        response = client.decrypt(\n            request={\n                \"name\": litellm._google_kms_resource_name,\n                \"ciphertext\": ciphertext,\n            }\n        )\n        secret = response.plaintext.decode(\"utf-8\")  # assumes the original value was encoded with utf-8\n\n    elif key_manager == KeyManagementSystem.AWS_KMS.value:\n        \"\"\"","sourceCodeStart":43,"sourceCodeEnd":79,"githubUrl":"https://github.com/BerriAI/litellm/blob/77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8/litellm/secret_managers/secret_manager_handler.py#L43-L79","documentation":"Google KMS branch guard in get_secret: the encrypted secret is expected to be read from an environment variable named after secret_name, but os.getenv returned None. The ciphertext blob was never placed in the environment.","triggerScenarios":"Thrown at litellm/secret_managers/secret_manager_handler.py:61 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Set the environment variable holding the KMS-encrypted ciphertext for the requested secret."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8","analyzedAt":"2026-08-18T11:44:31.656Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}