Disclosed weakness · no CVE recorded

LiteLLM could send original content after a Bedrock guardrail masked it

LiteLLM · LiteLLM Proxy

First documented disclosure · Review checkpoint

Summary

A Bedrock Converse request could send original sensitive text even after the configured guardrail had masked it.

Severity and exploitation evidence

No CVSS score recorded in this review.

Exploitation not established: The original source establishes the weakness but does not report malicious exploitation.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Redactions to messages or tool content were not reliably applied to the actual Bedrock Converse request.

Conditions required

A deployment uses Bedrock Converse with a masking policy.

Potential impact

Unredacted data could be submitted to the provider even though the guardrail had altered its own view.

Affected versions and configurations

The affected behavior is documented. The full version range is not established.

Fix and mitigation status

1.109.0 lists this correction; other release lines may differ.

Practical next steps

Use a release containing this correction. Confirm that the provider receives the policy-approved content.

Operating lesson

Test the data actually sent downstream, not only the mask returned by the filter.

Evidence and limits

The project describes the correction in the linked public changes and lists it in 1.109.0. No CVE assignment or complete affected range was established.

Sources