Nearly 1 in 10 Exposed LiteLLM Gateways Accepted the Example "sk-1234" Admin Key
-
Wiz Research scanned internet-facing LiteLLM servers in February and found that almost 1 in 10 of them accepted sk-1234 — the example admin key printed in LiteLLM's own setup guide.
LiteLLM is an open-source AI gateway, the layer a company places between its applications and the model providers it pays for. That key is the gateway's administrator credential, meaning anyone holding it can read every request passing through the gateway.
Key points:
- Roughly 10% of the exposed LiteLLM instances Wiz Research scanned accepted the default example admin key sk-1234.
- The key appears as an example in LiteLLM's official setup documentation, so it is widely known and trivially guessable.
- Holding the admin key grants full access to the gateway's traffic, including the data flowing between internal applications and paid model providers.
If your organization runs LiteLLM and it is reachable from the internet, verify that the admin key has been changed from the documented example and restrict exposure of the management interface.
Source: The Hacker News
Has your team audited its LiteLLM deployment for default or documented example credentials?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login