CuraSec

tag: Default-Credentials · 2 items

Act archived 10% of Internet-Exposed LiteLLM Gateways Use Default "sk-1234" Admin Key
2026-09-10 · The Hacker News · source ↗ #default-credentials#ai-gateway#misconfiguration
  • Engineer — Act: If you run LiteLLM, immediately check whether your admin key is still “sk-1234” and rotate it to a strong credential; a compromised gateway exposes all upstream model API keys and full prompt/completion history to anyone who finds the instance.
  • SOC/IR — Plan: Build a detection rule to flag any LiteLLM API requests authenticating with the literal string “sk-1234”, and sweep existing gateway/proxy logs since initial deployment for unauthorized admin activity.
  • Leader — Plan: Direct engineering to inventory all internal and vendor-managed LiteLLM deployments and confirm no default admin credentials are in use; a misconfigured AI gateway exposes both uncapped API spend and the full record of what your applications send to model providers.
Learn archived 220 million traveler records exposed via APIS default credentials
2026-09-08 · BleepingComputer · source ↗ #data-breach#pii-exposure#default-credentials
  • Engineer — Learn: The root cause — default credentials left on a cloud-exposed system — is a textbook misconfiguration. No specific software or CVE is named, so there is no patch to apply; use this as a prompt to audit your own cloud services for default or uncycled credentials.
  • SOC/IR — Skip
  • Leader — Learn: A breach of this scale — spanning nearly a decade of passport and travel data — illustrates third-party government data custody risk. No direct vendor relationship action is needed for most organizations, but it is useful context for board-level discussions on supply-chain and sovereign data exposure.