Nearly 1 in 10 Exposed LiteLLM Gateways Accepted the Example "sk-1234" Admin Key
Wiz found 294 of 3,074 internet-facing LiteLLM gateways accepted the documented default admin key sk-1234, exposing provider API keys and cloud IAM credentials.
Wiz Research's February Shodan scan found 3,074 LiteLLM gateways, 294 of which accepted the setup guide's sk-1234 admin key; 191 had no master key set and would accept any credential. The master key doubles as the authentication switch, and before 1.82.0-stable a gateway started without one granted every request full admin rights, exposing stored provider API keys, prompts, and MCP-connected tools. A documented pass-through endpoint lacks checks against private and cloud metadata addresses, letting an admin-key holder retrieve cloud IAM credentials, though no real-world abuse is reported. Related LiteLLM flaws include CVE-2026-59821 (disputed guardrail code execution), CVE-2026-59822 (CVSS 8.8, added to CISA KEV on September 2 and observed against Wiz honeypots), and CVE-2026-42271, used to install a cryptominer.
- 294 of 3,074 Shodan-visible LiteLLM gateways accepted the documented sk-1234 admin key; 191 set no master key.
- Pass-through endpoints lack SSRF checks, letting admin requests reach cloud metadata and return IAM credentials.
- CVE-2026-59821 severity disputed: Wiz demonstrates root-level code execution; LiteLLM advisory rates CVSS 2.1 Low.
- CVE-2026-59822 (CVSS 8.8) added to CISA KEV September 2; exploited against Wiz honeypots since July 7.
- CVE-2026-42271 used in the wild to install a cryptominer; chainable with Starlette flaw CVE-2026-48710.
- Organizations
- WizCISAHorizon3.ai
- Countries
- United States
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-40217 | LiteLLM through 2026-04-08 allows remote attackers to execute arbitrary code via bytecode rewriting at the /guardrails/test_custom_code URI | 8.8 | 17% | PoC | |
| CVE-2026-42271 | Command Injection in BerriAI LiteLLM AI Gateway Exploited in the Wild | 8.7 | 91% | KEV | KEV |
| CVE-2026-48710 | HTTP Request Smuggling in Kludex Starlette (CVE-2026-48710) | 6.5 | 70% | KEVPoC ×3 | KEV |
| CVE-2026-59821 | LiteLLM: LiteLLM's Custom Code Guardrails production create and update paths did not apply the same sandboxing and validation used by the… | 2.1 | <1% | ||
| CVE-2026-59822 | Unauthenticated MCP Endpoint Authentication Bypass in BerriAI LiteLLM | 8.8 | <1% | KEV | KEV |
From the original article
6 min read at thehackernews.com
Nearly one in ten of the internet-facing LiteLLM servers that Wiz Research scanned in February accepted sk-1234, the example admin key in LiteLLM's own setup guide. LiteLLM is an open-source AI gateway, the software a company puts between its applications and the model providers it pays for. That key is the gateway's administrator credential.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.