Type sk-1234, the placeholder key from LiteLLM’s own setup guide, into almost one in ten internet-facing LiteLLM servers and full administrative control is yours. Wiz Research found the exposure in February, and the guide still used the placeholder as of September 9.
The software is an open-source gateway. Companies slot it between their own applications and the model providers they pay. This one credential doubles as administrative access and as the control that forces authentication on. An install predating 1.82.0-stable behaved badly with no master key set: every request arriving at it gained admin treatment.
Scanning 3,074 gateways exposed on Shodan, Wiz turned up 294 that took sk-1234. Another 191 had no key configured whatsoever, meaning any value would have passed. An admin can read every stored provider key, watch every prompt, and reach the cloud identity credentials of the host. Wiz also showed that a pass-through endpoint, which forwards requests to any URL the admin picks, can be aimed at the instance metadata service to pull IAM credentials, using LiteLLM’s own header-prefix feature to satisfy IMDSv2.
There is no CVE and no patch. In LiteLLM’s threat model, administrators are assumed trustworthy. Rotating the key shuts every route Wiz outlined.
