10% of Internet-Exposed LiteLLM Gateways Use Default "sk-1234" Admin Key

Thu, 10 Sep 2026 14:58:06 +0000

Engineer — Act: If you run LiteLLM, immediately check whether your admin key is still “sk-1234” and rotate it to a strong credential; a compromised gateway exposes all upstream model API keys and full prompt/completion history to anyone who finds the instance.
SOC/IR — Plan: Build a detection rule to flag any LiteLLM API requests authenticating with the literal string “sk-1234”, and sweep existing gateway/proxy logs since initial deployment for unauthorized admin activity.
Leader — Plan: Direct engineering to inventory all internal and vendor-managed LiteLLM deployments and confirm no default admin credentials are in use; a misconfigured AI gateway exposes both uncapped API spend and the full record of what your applications send to model providers.

Ai-Gateway on CuraSec