Nearly One in 10 Exposed LiteLLM Gateways Took the Example Admin Key From Its Own Docs

Wiz Research reported on September 9 that 294 of the 3,074 internet-facing LiteLLM gateways it found in February accepted sk-1234, the example master key printed in LiteLLM's own setup guide, per Wiz. In 191 of them no key was set at all. LiteLLM is the open-source proxy a company puts between its applications and the model providers it pays. Whoever holds the admin key can read every provider API key stored on it.

Wiz does not report how many were compromised. The 294 is a count of exposed servers in one February scan. Two related flaws make that exposure worse, and both are patched. CVE-2026-59821 let custom guardrail code run without a sandbox and was fixed in v1.82.0 on February 25; paired with the default key, it gives code execution to anyone who can reach the server. CVE-2026-59822, an authentication bypass in the MCP endpoint, was fixed in v1.84.0 on April 25. Attackers have used it since at least July, and CISA added it to the Known Exploited Vulnerabilities catalog on September 2. On vulnerable hosts Wiz reached root and the machine's cloud IAM credentials. As of September 9 the setup guide still showed sk-1234, above a comment telling operators to replace it.

This week's federal advisory on distillation described a gray market in access to US frontier models. Provider keys lifted from an open gateway are exactly what that market runs on, and the owner of the key pays for the tokens.