Wiz Research found that 294 of 3,074 internet-facing LiteLLM AI gateways it scanned in February 2026 accepted "sk-1234" — the example admin key published in LiteLLM's own setup guide — while 191 of those accepted any key at all because no master key had been set. The master key is both the administrator credential and the switch that enables authentication: before version 1.82.0-stable, a gateway started without one granted every incoming request full admin rights.
| Attribute | Detail |
|---|---|
| Product | LiteLLM — open-source AI gateway |
| Scan | 3,074 exposed gateways (Feb 2026); 294 accepted "sk-1234", 191 accepted any key |
| Impact | Read every provider API key held; view all prompts and replies; reach MCP tools; inherit workload cloud IAM |
| Abuse pattern | LLMjacking — stolen provider keys used to run model workloads on the victim's bill |
| Fix | Change the master key; no upgrade required |
| CVE | CVE-2026-59821 (guardrail code execution, severity disputed: Wiz root RCE vs vendor Low 2.1) |
| Reported | 2026-09-10 |
Wiz also demonstrated that LiteLLM's pass-through endpoint does not validate target URLs against private address ranges, localhost or cloud metadata addresses, and that the documented x-pass- header pass-through defeats IMDSv2 — allowing an admin to point a route at the instance metadata service and read IAM credentials. No source has observed this against a real deployment; LiteLLM has no CVE for it and its published security policy lists attacks requiring setup mistakes, such as not setting a master key, as explicitly out of scope. A follow-up scan in August found more than 85,000 instances, but Wiz says most appear to be honeypots or test systems, so there is no comparable current figure. As of 9 September 2026 the setup guide still used sk-1234. Related: CVE-2026-59822 (LiteLLM improper authentication) was added to the CISA KEV catalogue on 2 September 2026. See malicious-litellm-releases-tied-to-trivy-hack-may-have-exposed-2-100-organisatio.md.