From 5155e7d02982c7db959518e38fee168c48e59683 Mon Sep 17 00:00:00 2001
From: Jeremy McGee <jeremymcgee6@gmail.com>
Date: Mon, 8 Jun 2026 09:33:50 -0400
Subject: [PATCH] fix(bedrock_mantle): validate aws_region_name before URL
 construction

Prevents bearer-token exfiltration via a malicious region value injected
through a proxy request. The resolved region is now validated against the
existing _validate_aws_region_name regex (lowercase alphanumerics and
hyphens only) before it is interpolated into the endpoint URL.

Flagged by Veria AI on PR #29711.
---
 .../bedrock_mantle/responses/transformation.py |  1 +
 ..._bedrock_mantle_responses_transformation.py | 18 ++++++++++++++++++
 2 files changed, 19 insertions(+)

diff --git a/litellm/llms/bedrock_mantle/responses/transformation.py b/litellm/llms/bedrock_mantle/responses/transformation.py
index e5dfcf8bb18..08d5b51ee27 100644
--- a/litellm/llms/bedrock_mantle/responses/transformation.py
+++ b/litellm/llms/bedrock_mantle/responses/transformation.py
@@ -56,6 +56,7 @@ class BedrockMantleResponsesAPIConfig(OpenAIResponsesAPIConfig, BaseAWSLLM):
         litellm_params: dict,
     ) -> str:
         explicit_region = self._explicit_region(litellm_params.get("aws_region_name"))
+        self._validate_aws_region_name(explicit_region)
         base = (
             api_base
             or get_secret_str("BEDROCK_MANTLE_API_BASE")
diff --git a/tests/test_litellm/llms/bedrock_mantle/test_bedrock_mantle_responses_transformation.py b/tests/test_litellm/llms/bedrock_mantle/test_bedrock_mantle_responses_transformation.py
index 0eed885ffc6..01efb92d52d 100644
--- a/tests/test_litellm/llms/bedrock_mantle/test_bedrock_mantle_responses_transformation.py
+++ b/tests/test_litellm/llms/bedrock_mantle/test_bedrock_mantle_responses_transformation.py
@@ -138,6 +138,24 @@ class TestBedrockMantleResponsesURL:
         url = cfg.get_complete_url(api_base=None, litellm_params={})
         assert url == "https://bedrock-mantle.us-east-2.api.aws/openai/v1/responses"
 
+    @pytest.mark.parametrize(
+        "malicious_region",
+        [
+            "us-east-2.attacker.com/",
+            "us-east-2.evil.com",
+            "foo/bar",
+            "us-east-1;rm -rf /",
+            "UPPER-CASE",
+        ],
+    )
+    def test_url_rejects_malicious_region(self, clear_aws_env, malicious_region):
+        cfg = BedrockMantleResponsesAPIConfig()
+        with pytest.raises(ValueError, match="Invalid AWS region format"):
+            cfg.get_complete_url(
+                api_base=None,
+                litellm_params={"aws_region_name": malicious_region},
+            )
+
 
 class TestBedrockMantleResponsesAuth:
     def test_config_api_key_takes_priority(self, monkeypatch):