Disclosed weakness · no CVE recorded

LiteLLM could omit a configured Bedrock guardrail on pass-through requests

BerriAI · LiteLLM Bedrock pass-through

First documented disclosure · Review checkpoint

Summary

A model’s administrator-configured Bedrock guardrail could be missing from inference requests routed through the proxy.

Severity and exploitation evidence

No CVSS score recorded in this review.

Exploitation not established: The maintainer documents the behavior and correction. The sources reviewed do not establish malicious use.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

One request path did not enforce the guardrail associated with the deployment, allowing the effective policy to depend on the caller.

Conditions required

A deployment has a Bedrock guardrail configured and accepts pass-through requests for that model.

Potential impact

A request could receive a response without the filtering policy the administrator intended. The sources do not identify a particular user or response.

Affected versions and configurations

Affected configurations before the backport on the 1.108 LTS line. The project does not give a complete affected-version range.

Fix and mitigation status

1.108.4 LTS includes this fix. The project also merged the upstream change on its main branch.

Practical next steps

Apply the 1.108.4 LTS update or a release verified to contain the fix. Confirm every permitted inference path applies the deployment’s configured guardrail.

Operating lesson

Verify the effective policy at the provider boundary for each request path exposed through a proxy.

Evidence and limits

The October 19 pull request merged October 20. The November 9 LTS notes explicitly identify it. No issue-specific CVE or severity score was established.

Sources