LiteLLM (48K stars) ships with master API key sk-1234 — full admin bypass on their AI Gateway. CVSS 9.8. Still unpatched in latest release.
Source Reddit Cybersecurity
Discussion
LiteLLM, an AI Gateway used to route requests to multiple large language model providers, ships with a hardcoded master API key 'sk-1234' in its default configuration. This key grants full administrative access, including generating unlimited API keys, reading all stored provider credentials, making inference calls billed to the victim, accessing spend logs, and modifying or deleting models. The default key is present in the . env.example file and referenced directly in docker-compose setups, with no startup validation or forced rotation. The vulnerability remains unpatched as of the latest release (1.86.0). Hundreds of exposed instances with default configurations are publicly accessible, increasing the risk of exploitation. The issue was reported recently and is awaiting vendor response.
r/cybersecurity (opens in a new tab)u/Lopsided_Selection560 points0 comments
- This post was deleted. Content shown was captured before removal.
LiteLLM is an AI Gateway used by enterprises to route requests to OpenAI, Anthropic, Azure, Bedrock, Vertex, and 100+ other LLM providers. It handles API keys, rate limiting, cost tracking, and load balancing.
The default .env.example ships with:
LITELLM_MASTER_KEY = "sk-1234"
The docker-compose.yml references this .env file directly.
THE AUTH CODE (user_api_key_auth.py:1257):
is_master_key_valid = secrets.compare_digest(api_key, master_key)
if is_master_key_valid:
user_role = PROXY_ADMIN // root access
There is NO startup validation. NO warning. NO forced rotation.
The key "sk-1234" is used in EVERY test file. It's been the default for years.
WHAT YOU GET WITH sk-1234:
- Generate unlimited API keys
- Read all stored provider credentials (OpenAI, Anthropic, Azure, etc.)
- Make inference calls on ANY configured provider (billed to victim)
- Access full spend logs with prompts and responses
- Create admin users, modify routing, delete models
LIVE DEMO:
I deployed LiteLLM 1.86.0 (latest), started the proxy with default config:
curl -H "Authorization: Bearer sk-1234" http://localhost:4000/health
→ 200 OK
curl -H "Authorization: Bearer sk-1234" http://localhost:4000/v1/models
→ 200 OK - full model list
curl -X POST -H "Authorization: Bearer sk-1234" http://localhost:4000/key/generate
→ Would generate admin API keys (needs Postgres configured)
Shodan query: title:"LiteLLM" port:4000
→ Hundreds of exposed instances, many likely with default key.
GitHub issue: https://github.com/BerriAI/litellm/issues/28797
Reported: Today. Status: Awaiting response.
If you deploy LiteLLM from docker-compose without changing the default .env,
your entire AI gateway is wide open. Change your master key NOW.