Researchers found that a significant share of internet-exposed LiteLLM gateways could be administered using the example API key "sk-1234", potentially letting outsiders control or abuse those AI gateway deployments. The issue is a dangerous insecure-default or misconfiguration exposure rather than a newly assigned CVE: administrators appear to have left LiteLLM management endpoints reachable from the internet while keeping the sample admin credential in place, affecting publicly accessible LiteLLM gateway instances at measurable scale.
Why it matters: Organizations using LiteLLM may have unintentionally left a front door open to their AI gateway and any connected model access or secrets behind it. Admins should immediately rotate keys, remove example credentials, restrict management interfaces from the public internet, and review logs for unauthorized use.
info@thehackernews.com (The Hacker News)
2026.09.10
100% relevant
This article appears to establish a distinct new exposure story about default admin-key acceptance on publicly reachable LiteLLM gateways, not a specific CVE or the existing KEV-listed LiteLLM command-injection flaw.
← Back to all stories