From 5e57f966dcbbf762f2d3e29912bd964b555a11a8 Mon Sep 17 00:00:00 2001
From: user <70670632+stuxf@users.noreply.github.com>
Date: Sun, 31 May 2026 09:42:54 +0000
Subject: [PATCH] chore(proxy): treat aws_web_identity_token as a stored
 credential in the destination-change guards

aws_sts_endpoint was guarded as a destination, but aws_web_identity_token was not in the credential set, so repointing the STS endpoint while supplying an unrelated credential left a stored web identity token riding along to the attacker's AssumeRoleWithWebIdentity call. Added it to both _CREDENTIAL_LITELLM_PARAMS and _HEALTH_CREDENTIAL_FIELDS, with a regression test that repointing aws_sts_endpoint without re-supplying the token is rejected.
---
 .../proxy/health_endpoints/_health_endpoints.py    |  1 +
 .../model_management_endpoints.py                  |  1 +
 .../test_model_management_endpoints.py             | 14 ++++++++++++++
 3 files changed, 16 insertions(+)

diff --git a/litellm/proxy/health_endpoints/_health_endpoints.py b/litellm/proxy/health_endpoints/_health_endpoints.py
index 9b1fe29471b..0e677a10a5f 100644
--- a/litellm/proxy/health_endpoints/_health_endpoints.py
+++ b/litellm/proxy/health_endpoints/_health_endpoints.py
@@ -83,6 +83,7 @@ _HEALTH_CREDENTIAL_FIELDS = (
     "litellm_credential_name",
     "aws_secret_access_key",
     "aws_session_token",
+    "aws_web_identity_token",
     "azure_ad_token",
     "vertex_credentials",
 )
diff --git a/litellm/proxy/management_endpoints/model_management_endpoints.py b/litellm/proxy/management_endpoints/model_management_endpoints.py
index f1eab257253..43601dcf8ad 100644
--- a/litellm/proxy/management_endpoints/model_management_endpoints.py
+++ b/litellm/proxy/management_endpoints/model_management_endpoints.py
@@ -76,6 +76,7 @@ _CREDENTIAL_LITELLM_PARAMS = (
     "litellm_credential_name",
     "aws_secret_access_key",
     "aws_session_token",
+    "aws_web_identity_token",
     "azure_ad_token",
     "vertex_credentials",
 )
diff --git a/tests/test_litellm/proxy/management_endpoints/test_model_management_endpoints.py b/tests/test_litellm/proxy/management_endpoints/test_model_management_endpoints.py
index d00d52c26ad..48b2fbff54c 100644
--- a/tests/test_litellm/proxy/management_endpoints/test_model_management_endpoints.py
+++ b/tests/test_litellm/proxy/management_endpoints/test_model_management_endpoints.py
@@ -2544,3 +2544,17 @@ class TestModelMgmtAuthzHardening:
             self._assert_resupply(
                 {"sagemaker_base_url": "https://attacker.example"}, db
             )
+
+    def test_sts_endpoint_change_requires_web_identity_token_resupply(self):
+        from litellm.proxy._types import ProxyException
+
+        # Repointing aws_sts_endpoint must require re-supplying a stored web
+        # identity token; supplying an unrelated credential must not let it ride.
+        db = {
+            "aws_sts_endpoint": "https://sts.real",
+            "aws_web_identity_token": "stored-token",
+        }
+        with pytest.raises(ProxyException):
+            self._assert_resupply(
+                {"aws_sts_endpoint": "https://sts.attacker", "api_key": "x"}, db
+            )