Nearly 1 in 10 Exposed LiteLLM Gateways Accepted the Example "sk-1234" Admin Key

Wiz Research discovered a severe misconfiguration affecting LiteLLM deployments across the internet. Nearly 10 percent of exposed LiteLLM gateways accepted sk-1234, the default example administrator key published in LiteLLM's official setup documentation.

LiteLLM functions as an AI gateway, acting as middleware between an organization's applications and third-party model providers like OpenAI or Anthropic. The gateway handles API routing, rate limiting, and cost management. The administrator key grants full control over these functions. Possession of this credential allows attackers to read every API request and response flowing through the gateway, modify billing configurations, extract authentication tokens for downstream AI services, and potentially inject malicious prompts or intercept sensitive data.

The vulnerability stems from a documentation problem. LiteLLM's setup guide includes sk-1234 as a placeholder example for the admin key. Organizations that deployed LiteLLM without changing this default value left their gateways openly accessible to anyone who knows the standard key. This represents a textbook case of default credential exposure.

Wiz Research's February scan identified approximately 500 internet-facing LiteLLM instances. Among those scanned, roughly 50 servers accepted the example key without modification. This finding indicates that operators deployed LiteLLM instances with minimal configuration changes, treating the setup guide's example values as functional defaults rather than security placeholders that require replacement.

The exposure window for affected organizations spans potentially months or years. Attackers need only know that LiteLLM runs on a target server and attempt authentication with sk-1234. No sophisticated reconnaissance or exploitation techniques apply here. Public scanning tools like Shodan can identify LiteLLM instances by their HTTP response headers.

An attacker controlling an admin key gains access to comprehensive gateway telemetry. They observe which AI models organizations use, their usage patterns, and the volume of API calls. They extract API keys for downstream services, enabling unauthorized access to paid AI services at the victim's expense. They read request and response data, potentially containing proprietary prompts, training data, or business logic embedded in model queries. They modify routing rules to redirect requests to attacker-controlled servers or intercept responses before they reach applications.

The risk extends beyond individual organizations. Compromised gateways become pivot points for supply chain attacks. If a company uses LiteLLM to serve AI capabilities to multiple clients, a single gateway compromise affects all downstream consumers.

LiteLLM maintainers should update documentation to explicitly warn against using example keys in production and provide automated validation that checks for default credentials at startup. Organizations currently running LiteLLM must immediately change the admin key from sk-1234 to a cryptographically random value, rotate any exposed API keys for downstream services, audit gateway logs for unauthorized access patterns, and implement network segmentation to restrict gateway access to internal applications only.

This incident reflects a broader pattern in AI infrastructure. As organizations rapidly adopt LLM gateways and AI middleware, security configuration lags behind deployment velocity. The ease of this attack demonstrates that threat actors will exploit the path of least resistance, and default credentials remain among the lowest-resistance attack surfaces available.