fix(router): enforce team scope for credential lookup

litellm/router.py

@@ -9577,6 +9577,8 @@ class Router:
         """
         # Try to get deployment by model_id first
         deployment = self.get_deployment(model_id=model_id)
+        if deployment is not None and team_id is not None and not self._deployment_usable_by_team(deployment, team_id):
+            deployment = None
 
         # If not found, try by model_group_name
         if deployment is None:

tests/test_litellm/test_router.py

@@ -4739,6 +4739,37 @@ def test_get_deployment_credentials_with_provider_no_fallback_to_other_team_only
     )
 
 
+def test_get_deployment_credentials_with_provider_rejects_other_team_exact_id():
+    router = litellm.Router(
+        model_list=[
+            {
+                "model_name": "team-b-model",
+                "litellm_params": {
+                    "model": "openai/gpt-5.2",
+                    "api_key": "team-b-key",
+                },
+                "model_info": {
+                    "id": "team-b-deployment",
+                    "team_id": "team-b",
+                },
+            },
+        ],
+    )
+
+    owner_credentials = router.get_deployment_credentials_with_provider(
+        model_id="team-b-deployment", team_id="team-b"
+    )
+    assert owner_credentials is not None
+    assert owner_credentials["api_key"] == "team-b-key"
+
+    assert (
+        router.get_deployment_credentials_with_provider(
+            model_id="team-b-deployment", team_id="team-a"
+        )
+        is None
+    )
+
+
 def test_deployment_usable_by_team_helpers():
     """
     Direct coverage of the team-ownership filter: a team-scoped deployment is