Wiz Finds 294 LiteLLM Gateways Still Accept sk-1234 Default Key
TL;DR
- Wiz scanned 3,074 internet-facing LiteLLM gateways in February 2026 and found 294 accepted `sk-1234`, the example admin key in LiteLLM's own setup guide.
- CVE-2026-59822, an MCP authentication bypass at CVSS 8.8, was added to CISA's Known Exploited Vulnerabilities catalog on September 2 with a September 16 patch deadline.
- Microsoft observed attackers reading the container's environment for the master key, provider keys, and DB connection string, then accessing the underlying PostgreSQL database.
Wiz Research scanned 3,074 internet-facing LiteLLM gateways in February 2026 and found 294 of them accepted `sk-1234`, the example admin key printed in LiteLLM's own setup guide. Of those, 191 had no master key set at all.
"Nearly one in ten of the internet-facing LiteLLM servers that Wiz Research scanned in February accepted sk-1234, the example admin key in LiteLLM's own setup guide," The Hacker News reported. The master key doubles as the administrator credential. "Anyone who holds it can read every model provider's API key stored on the server," the report says, and the same credential opens a path to cloud IAM credentials on the underlying host.
Wiz bundled the finding with four CVEs. CVE-2026-59822, an MCP authentication bypass at CVSS 8.8, was added to CISA's Known Exploited Vulnerabilities catalog on September 2, with federal civilian agencies given until September 16 to patch. Wiz says the bug hit its own honeypots on July 7. CVE-2026-42271, a command execution flaw at CVSS 8.7, affects versions 1.74.2 through 1.83.6 and has been used in the wild to deploy a cryptocurrency miner. A custom-guardrail bypass and a bytecode sandbox escape round out the set. All four are addressed in LiteLLM 1.84.0.
Microsoft documented one exploitation chain in which attackers "ran commands inside a LiteLLM gateway process, read the container's environment for the master key, the provider keys, and the database connection string, and then used that string to access the underlying PostgreSQL database." Its guidance to defenders: "Treat AI gateways as Tier-0 secrets stores." Anthropic detailed four Claude cyber incidents this week, with METR set to audit.
The awkward part sits in LiteLLM's own policy, which lists attacks that require a "setup mistake, such as not setting a master key," as "explicitly not in scope." At publication, the project's setup guide still prints `sk-1234` above a comment telling operators to replace it with a long random value before any real use.
Originally reported by thehackernews.com
Read the original article →Original headline: Wiz: 294 of 3,074 Public LiteLLM Gateways Still Accept the sk-1234 Example Admin Key