Affected Systems

LiteLLM open-source AI gateway: 294 of 3,074 internet-facing instances scanned in February 2026 accepted the example admin key "sk-1234" from setup documentation. 191 had no key set at all; remainder used the documented default. All versions prior to 1.82.0-stable grant full admin rights when no master key is configured.

Exploitation Status

Active exploitation confirmed for related CVE-2026-59822 (MCP authentication bypass) since July 7, 2026 against Wiz honeypots. CISA added it to KEV catalog September 2, 2026. No public reports of exploitation of the default key issue itself, but Wiz demonstrated full attack chain including cloud credential theft via SSRF to instance metadata service.

Business Impact

Organizations running LiteLLM with default or missing master keys face immediate risk of full gateway compromise. Attackers gain access to all stored API keys for model providers (enabling LLMjacking fraud), can intercept prompts and responses, reach cloud IAM credentials via pass-through endpoint SSRF to metadata services (including IMDSv2), and access internal tools via Model Context Protocol. This is a configuration issue, not a CVE—LiteLLM's security policy explicitly excludes setup mistakes from vulnerability scope. Two related code execution CVEs (CVE-2026-59821, CVE-2026-40217) were patched in February and April 2026 but required admin access.

Urgency

🔴 Immediate

Recommended Actions

  • Immediately audit all LiteLLM deployments and replace any master key set to 'sk-1234' or left unset with a cryptographically random value of at least 32 characters
  • Upgrade LiteLLM to version 1.83.10 or later to address CVE-2026-59821 (guardrail code execution), CVE-2026-40217 (sandbox escape), and CVE-2026-59822 (MCP authentication bypass)
  • Review LiteLLM access logs for unauthorized admin API calls, especially to /key/info, /key/generate, pass-through endpoint creation, and guardrail modification endpoints
  • Restrict network access to LiteLLM admin interfaces using firewall rules or VPC security groups—these should never be internet-facing without additional authentication layers
  • Rotate all model provider API keys and cloud IAM credentials accessible to any LiteLLM instance that may have been exposed with default credentials