Nearly 1 in 10 Exposed LiteLLM Gateways Accepted the Example "sk-1234" Admin Key — SkimNews
Get the Tech newsletter
Daily tech — startups, AI labs, chips, the launches that shape the next decade. Free.
- Wiz Research found that 294 of 3,074 internet-facing LiteLLM gateways scanned in February accepted the default "sk-1234" admin key from the project's setup guide; 191 of those had no key set at all and would have accepted any value.
- The "sk-1234" key functions as both the admin credential and the authentication switch, and before version 1.82.0-stable a gateway started without a master key granted every incoming request full administrator rights.
- Wiz demonstrated that LiteLLM's pass-through endpoint feature, which forwards requests to any admin-chosen URL, can reach cloud instance metadata services and harvest IAM credentials — including bypassing IMDSv2 by using the documented "x-pass-" header prefix.
- CISA added CVE-2026-59822 (CVSS 8.8), an unauthenticated MCP-session flaw also found by Wiz, to its Known Exploited Vulnerabilities catalog on September 2, giving federal civilian agencies until September 16 to remediate it.
- Microsoft reported in August that attackers ran commands inside a LiteLLM gateway, harvested the master key, provider keys, and PostgreSQL connection string from the container's environment, and copied records from the model and virtual-key tables.
- LiteLLM's setup guide still used "sk-1234" as of September 9, and the project's published security policy lists attacks that require a setup mistake — such as leaving the default key in place — as "explicitly not in scope," with no CVE issued for the metadata-route path.
Why it matters: For AI-platform teams running LiteLLM, the master key is a Tier-0 secret: holding it exposes every provider API key and cloud IAM credential, and — as Microsoft's August case showed — full prompt and virtual-key tables. With roughly 10% of scanned gateways still accepting the setup-guide default and a confirmed exploitation chain already in use, the gap between applying a patch and rotating stored credentials is now the live attack surface.
Ask SkimNews
