1 in 10 Exposed LiteLLM Servers Accept Default Admin Key — SkimNews
Get the Tech newsletter
Daily tech — startups, AI labs, chips, the launches that shape the next decade. Free.
- Wiz Research found 294 of 3,074 internet-facing LiteLLM servers scanned in February (nearly 1 in 10) accepted the example admin key "sk-1234" from the project's own setup guide, and in 191 of those 294, no key had been set at all.
- LiteLLM does not treat the pass-through endpoint feature that lets an admin point a route at cloud instance metadata services and harvest IAM credentials as a vulnerability — the project has issued no CVE and no fix, and its security policy explicitly excludes setup-mistake attacks from scope.
- The severity of CVE-2026-59821 is disputed between reporter and maintainer: Wiz calls it post-authentication root-level code execution, while LiteLLM's own advisory rates it Low at 2.1 CVSS and describes it as requiring a high-privilege account.
- CISA added CVE-2026-59822 (CVSS 8.8) to its Known Exploited Vulnerabilities catalog on September 2, giving federal civilian agencies until September 16 to address it; Wiz recorded single-character Bearer tokens probing its honeypots starting July 7.
- Microsoft documented attackers using the CVE-2026-42271 and CVE-2026-48710 chain to read the LiteLLM master key from a container's environment variables, then access the underlying PostgreSQL database and copy records from model and virtual-key tables; Wiz's honeypots recorded the same chain being used to install a cryptocurrency miner.
- LiteLLM's setup guide still used "sk-1234" as the example value as of September 9; upgrading to version 1.84.0 or later covers every flaw in Wiz's report, though changing the master key itself requires no upgrade.
Why it matters: Organizations running LiteLLM gateways with the default "sk-1234" master key have a single-credential exposure to their full API-key store and cloud IAM, and attackers are already exploiting it: CISA added one related LiteLLM flaw to its exploited-vulnerability catalog on September 2, and Microsoft documented attackers who read the master key from a container's environment and copied records from the underlying database.
Ask SkimNews
