News · 2026-09-12

Nearly one in ten internet-facing LiteLLM AI gateways accepted the default admin key 'sk-1234', Wiz found

Security firm Wiz found that 294 of 3,074 publicly reachable LiteLLM servers, 9.6%, accepted the example master key "sk-1234" from the software's own documentation or required no authentication at all. LiteLLM is a popular open-source gateway that companies use to route traffic to AI providers. Wiz chained that exposure with several flaws, now patched, to get root-level code execution and steal cloud credentials, and one of the bugs is already on the US government's list of vulnerabilities exploited in the wild.

Key facts

• 9.6% of 3,074 internet-facing LiteLLM instances in a February 2026 scan accepted the default key or had no authentication; 191 of them, 6.2%, had no authentication at all.
• When: Wiz published the research on 9 September 2026, after presenting it at DEF CON 34. CISA added the MCP bypass flaw to its exploited-vulnerabilities catalogue on 2 September.
• Who: Wiz researchers Amitai Cohen and Yaara Shriki, who used Anthropic's Claude Code to search LiteLLM's codebase.
• Primary source: Wiz's write-up and LiteLLM's security advisories.

The switchboard in the middle of your AI stack

LiteLLM sits between a company's applications and more than 100 AI providers, including OpenAI, Anthropic, AWS Bedrock and Google Vertex AI. Companies route traffic through it to manage API keys, enforce budgets and apply guardrails in one place. According to Wiz's data it is present in about a third of cloud environments.

That makes it a single point that holds everything. As Wiz puts it, a LiteLLM instance "can hold API keys for every configured LLM provider, process every prompt and response that flows through it, and connect to external tools via MCP," the Model Context Protocol that links AI models to databases, code repositories and chat tools.

The usual fear with an exposed gateway is "LLMjacking," strangers running up an AI bill on your keys. Wiz wanted to know whether an attacker could do worse. "We decided to use Claude Code to work through LiteLLM's codebase, looking for features that accept user-controlled input and pass it to an execution context," the researchers write.

What they found

A one-character password. LiteLLM's MCP endpoint was supposed to pass unrecognised tokens on to upstream services. Instead, when a token failed validation, the handler "catches the 401 error and silently returns an empty auth object - granting access as if the request were authenticated." Wiz showed that the header Authorization: Bearer a "is enough to establish a fully authenticated MCP session," giving access to whatever tools the gateway connects to. This is CVE-2026-59822, fixed in version 1.84.0. Wiz says it saw the flaw exploited in its honeypots in July.

Guardrails that ran as root. LiteLLM lets administrators write custom "guardrail" code that checks every request. The test button ran that code in a restricted sandbox, but the endpoint that actually saves the guardrail did not. Wiz's proof of concept returned uid=0(root). This is CVE-2026-59821, fixed in version 1.82.0; LiteLLM's own advisory rates it low severity.

Admin for everyone by default. Before the fix, when no master key was configured, "LiteLLM's auth handler globally assigned the PROXY_ADMIN role to every incoming request."

The key in the docs. LiteLLM's quickstart guides use sk-1234 as the example master key, and that key also signs session tokens, so anyone who knows it can forge a login. "As of today, the master key is still set by default to sk-1234 when installing LiteLLM via Docker compose or pip install," Wiz writes.

It is like a building whose master key ships stamped "1234," with a sign in the lobby saying so.

From the gateway to the cloud. A LiteLLM administrator can create pass-through routes to any web address. Wiz pointed one at the cloud server's internal metadata service and got back live AWS credentials, even defeating AWS's stronger IMDSv2 protection by abusing header forwarding. LiteLLM treats administrators as trusted, so this is not considered a vulnerability and is not patched. Combined with a default key, it becomes an outside attacker's route into the cloud account.

Why it matters

AI gateways went from developer convenience to critical infrastructure in about two years, and their security has not kept up. "These systems need to be treated as Tier-1 security assets rather than developer tools," Wiz concludes. The Hacker News reported that Microsoft, describing a separate intrusion through an exposed LiteLLM gateway, gave similar advice: "Treat AI gateways as Tier-0 secrets stores."

The research also shows AI on the defenders' side. The same kind of coding agent that attackers now use to run whole campaigns found these bugs for a security team first. For anyone running agents, the lesson from sandboxing applies to the plumbing too: give it only the permissions it needs.

What to do

Upgrade to LiteLLM 1.84.0 or later, which The Hacker News says covers every flaw in its table, and set a strong, unique master key. Wiz also recommends reviewing guardrails for unexpected entries, auditing pass-through endpoints, restricting outbound network access from the container, and giving the gateway least-privilege cloud roles.

The caveat

The 9.6% figure comes from a February 2026 scan of instances visible on the Shodan search engine, before most patches shipped, so today's exposure may be lower. A follow-up scan in August found more than 85,000 instances, but Wiz says most appear to be honeypots or test deployments.

Primary source, verified: read the paper →

Ground Truth. (2026, September 12). Nearly one in ten internet-facing LiteLLM AI gateways accepted the default admin key 'sk-1234', Wiz found. Ground Truth. https://groundtruth.day/news/nearly-one-in-ten-exposed-litellm-ai-gateways-accepted-the-default-admin-key.html

@misc{groundtruth:nearly-one-in-ten-exposed-litellm-ai-gateways-accepted-the-default-admin-key,
  title  = {Nearly one in ten internet-facing LiteLLM AI gateways accepted the default admin key 'sk-1234', Wiz found},
  author = {{Ground Truth}},
  year   = {2026},
  month  = {sep},
  url    = {https://groundtruth.day/news/nearly-one-in-ten-exposed-litellm-ai-gateways-accepted-the-default-admin-key.html}
}

Topics: cybersecurity · ai-security · vulnerabilities · mcp · ai-infrastructure · default-credentials