diff --git a/litellm/proxy/auth/auth_utils.py b/litellm/proxy/auth/auth_utils.py
index 18aea48e96b..1342a6e2927 100644
--- a/litellm/proxy/auth/auth_utils.py
+++ b/litellm/proxy/auth/auth_utils.py
@@ -151,7 +151,28 @@ def is_request_body_safe(
     A malicious user can set the api_base to their own domain and invoke POST /chat/completions to intercept and steal the OpenAI API key.
     Relevant issue: https://huntr.com/bounties/4001e1a2-7b7a-4776-a3ae-e6692ec3d997
     """
-    banned_params = ["api_base", "base_url", "user_config"]
+    banned_params = [
+        "api_base",
+        "base_url",
+        "user_config",
+        # Cloud provider credential params — these are deployment-level settings
+        # and must not be overridable from user-supplied request bodies.
+        "vertex_credentials",
+        "vertex_ai_credentials",
+        "vertex_project",
+        "vertex_ai_project",
+        "vertex_location",
+        "vertex_ai_location",
+        "aws_access_key_id",
+        "aws_secret_access_key",
+        "aws_session_token",
+        "aws_region_name",
+        "aws_profile_name",
+        "aws_role_name",
+        "aws_web_identity_token",
+        "azure_ad_token",
+        "azure_ad_token_provider",
+    ]
 
     for param in banned_params:
         if (