Nearly 1 in 10 Exposed LiteLLM Gateways Accepted the Example "sk-1234" Admin Key

Wiz Research has identified that nearly one in ten internet-facing LiteLLM gateways accept the default "sk-1234" admin key documented in the official setup guide, exposing sensitive credentials and potentially allowing cloud infrastructure compromise. This misconfiguration exacerbates risks from several critical vulnerabilities in the BerriAI product, including CVE-2026-59822, which is already being actively exploited in the wild, and CVE-2026-42271, which permits unauthorized code execution on the host system.

Administrators are advised to immediately replace the master key with a strong random value and upgrade their installations to version 1.84.0 or later to mitigate these threats.