Issue evidence · AI API · BerriAI/litellm

Router fallback to bedrock/ (and bedrock_mantle/) sends the caller's forwarded API key to AWS instead of SigV4-signing

GitHub issue: https://github.com/BerriAI/litellm/issues/45309

Reproduced

When a router falls back to a Bedrock deployment, the caller's own API key goes to AWS as a bearer token.

What Badgr ran

Installed litellm 1.104.2 and ran the issue's router with a mocked Bedrock endpoint, a caller key of the form sk-ant-api03-..., and the fallback to bedrock/ triggered. No cloud account was used.

What came back

  • The mocked Bedrock request carried "Authorization: Bearer <the caller's key>" instead of a SigV4 signature.
  • The script printed LEAK.

CPU only, no GPU. The key in the run was a made-up test value. A routing layer that forwards caller credentials on fallback is the kind of thing a verified-execution check should catch.

Checked 2026-10-11 in Badgr’s local development environment.

← All issue evidence