WIZ Research has found a serious exposure in LiteLLM, an open‑source AI gateway that sits between applications and model providers. In February, Wiz scanned Shodan for LiteLLM instances and found 3,074 gateways, of which 294 accepted the example admin key sk-1234 from LiteLLM’s own setup guide. A further August scan tallied more than 85,000 instances, though Wiz cautions many appear to be honeypots or test systems, so the two counts aren’t directly comparable.
LiteLLM’s setup guide still instructs operators to replace sk-1234 with a long random value, but the article notes that the master key doubles as both the administrator credential and the authentication switch, meaning the default value can grant full admin rights and open routes to connect to cloud credentials. The weaponised risk is that whoever holds the key can read every model provider API key stored on the server and even access cloud IAM credentials from the hosting machine.
The report details several CVEs and the associated risks. CVE-2026-59821 concerns a code‑execution path that Wiz describes as post‑authentication root access, though LiteLLM’s advisory frames it as a lower severity depending on context. CVE-2026-40217 describes a sandbox escape vector in the guardrails, while CVE-2026-42271 relates to MCP test endpoints that could let an authenticated user run commands on the host; CVE-2026-59822 is an MCP authentication bypass affecting unauthorised access.
Upgrading to 1.84.0 or later is recommended to cover the fixed scope, and several workaround steps are listed if upgrade isn’t feasible (for example, blocking MCP endpoints and guardrail paths, restricting guardrail modifications to admins, rotating the master key, and limiting outbound network access). The article also notes that the exposed pass‑through route to instance metadata remains unpatched, and that the advisory notes no CVE initially, with fixes published months earlier in 2024–2026.