Nearly 10% of Internet-Facing LiteLLM Gateways Exposed to Default Admin Key

Default Admin Key Exposure

Wiz Research discovered that 294 of 3,074 internet-facing LiteLLM gateways scanned in February accepted the default example admin key "sk-1234". This key is provided in LiteLLM's setup guide and is intended to be replaced before production use. In 191 of these instances, no key was set, meaning any value would have been accepted, while the rest retained the default value.

Impact of Key Compromise

Possession of this master key grants an attacker administrative access to the LiteLLM gateway. This allows them to read all model provider API keys stored on the server, view prompts and replies passing through, and connect to internal tools via the Model Context Protocol (MCP). Additionally, the gateway often runs with the cloud permissions of its deployment environment, enabling attackers to potentially access cloud IAM credentials and run model workloads on the victim's bill, a practice known as LLMjacking.

Mechanism of Cloud Account Access

LiteLLM allows administrators to create pass-through endpoints that forward requests to any chosen URL. The system does not validate target URLs against private address ranges or cloud metadata addresses. This oversight enables an administrator, or an attacker with the master key, to point a route at the instance metadata service and retrieve IAM credentials, even with IMDSv2 in use. Headers with an "x-pass-" prefix are also forwarded to the target, which could be exploited.

Addressing the Vulnerability

The primary mitigation for this vulnerability is to change the default admin key. This action alone closes all identified attack paths that rely on holding the default key. LiteLLM's setup guide still includes the "sk-1234" example, with a comment advising users to replace it with a strong, random value before deployment. Before version 1.82.0-stable, gateways started without a master key would grant full admin rights to all incoming requests.