hacker-news · Crawled Sep 10, 2026
Nearly 1 in 10 Exposed LiteLLM Gateways Accepted the Example "sk-1234" Admin Key
4 CVEs
Read original article ↗
AI Summary
Wiz Research identified that nearly 1 in 10 internet-facing LiteLLM gateways accepted the default example admin key 'sk-1234', exposing critical cloud IAM credentials and API keys. Attackers with access to the master key can read all model provider API keys, execute code via misconfigured endpoints, and exploit pass-through routing to harvest cloud instance metadata. Multiple CVEs have been documented, including authentication bypasses and post-authentication code execution flaws, some of which are already being exploited in the wild to deploy cryptocurrency miners and extract sensitive data. Despite patches, many deployments remain vulnerable due to misconfigurations and unrotated default keys.
AI-extracted · verify before operational use
Extracted Entities 4 found
MITRE ATT&CK TTPs 20 techniques
T1048 Exfiltration Over Alternative Protocol · Exfiltration T1059.003 Windows Command Shell · Execution T1078 Valid Accounts · Defense Evasion T1082 System Information Discovery · Discovery T1090 Proxy · Command And Control T1133 External Remote Services · Persistence T1190 Exploit Public-Facing Application · Initial Access T1211 Exploitation for Defense Evasion · Defense Evasion T1552 Unsecured Credentials · Credential Access T1555 Credentials from Password Stores · Credential Access T1003 OS Credential Dumping · Credential Access T1012 Query Registry · Discovery T1059 Command and Scripting Interpreter · Execution T1059.001 PowerShell · Execution T1078.004 Cloud Accounts · Defense Evasion T1566 Phishing · Initial Access T1071.001 Web Protocols · Command And Control T1105 Ingress Tool Transfer · Command And Control T1203 Exploitation for Client Execution · Execution T1210 Exploitation of Remote Services · Lateral Movement