Exposed LiteLLM Gateways Allow Default-Key Takeover and Cloud Credential Theft
Active Exploitation · 5 sources · Updated 2mo ago · First seen Sep 9, 2026
Wiz researchers found that 294 of 3,074 internet-facing LiteLLM gateways accepted the documented default administrator key, sk-1234, while 191 had no master-key authentication configured. An attacker with master-key access can retrieve model-provider API keys, inspect prompts and responses, access MCP-connected tools, and abuse unrestricted pass-through endpoints to query cloud instance metadata services and obtain IAM credentials.
The exposure coincides with multiple LiteLLM flaws, including actively exploited MCP authentication bypass CVE-2026-59822, which allows arbitrary Bearer tokens to create authenticated MCP sessions, and Python code execution CVE-2026-59821 through custom code guardrails in versions before 1.82.0. Organizations should upgrade to LiteLLM 1.84.0 or later, replace and rotate default master keys, remove public access to management and MCP endpoints, restrict container egress, and enforce least-privilege cloud IAM permissions.
