Act
active
10% of Internet-Exposed LiteLLM Gateways Use Default "sk-1234" Admin Key
- Engineer — Act: If you run LiteLLM, immediately check whether your admin key is still “sk-1234” and rotate it to a strong credential; a compromised gateway exposes all upstream model API keys and full prompt/completion history to anyone who finds the instance.
- SOC/IR — Plan: Build a detection rule to flag any LiteLLM API requests authenticating with the literal string “sk-1234”, and sweep existing gateway/proxy logs since initial deployment for unauthorized admin activity.
- Leader — Plan: Direct engineering to inventory all internal and vendor-managed LiteLLM deployments and confirm no default admin credentials are in use; a misconfigured AI gateway exposes both uncapped API spend and the full record of what your applications send to model providers.
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.