LiteLLM is an open-source AI gateway, the layer a company places between its applications and the model providers it pays for. That key is the gateway's administrator credential, meaning anyone holding it can read every request passing through the gateway.

Key points:

• Roughly 10% of the exposed LiteLLM instances Wiz Research scanned accepted the default example admin key sk-1234.
• The key appears as an example in LiteLLM's official setup documentation, so it is widely known and trivially guessable.
• Holding the admin key grants full access to the gateway's traffic, including the data flowing between internal applications and paid model providers.

If your organization runs LiteLLM and it is reachable from the internet, verify that the admin key has been changed from the documented example and restrict exposure of the management interface.

Source: The Hacker News
Has your team audited its LiteLLM deployment for default or documented example credentials?