1 in 10 Exposed AI Gateways Are Still Using the Example Admin Key From the Docs

Table of Contents

• 1. The Key Everyone Was Told to Change
• 2. What an AI Gateway Actually Guards
• 3. The Numbers Wiz Research Found
• 4. What "sk-1234" Actually Unlocks
• 5. This Wasn't the Only Way In
• 6. Why "Tier-0 Secrets Store" Is the Right Way to Think About This
• 7. Fixing It—Today, Not After an Upgrade Window
• 8. Why Smart Engineers Still Ship the Example Value
• 9. Build These Skills—Innovative Academy
• 10. Final Thoughts

Every setup guide has that one line everyone skims past: "Replace this value before going to production."

Wiz Research's disclosure, published in September 2026, is a clean, uncomfortable reminder of how often that line gets skimmed and never actually followed—nearly one in ten internet-exposed LiteLLM AI gateways were found still using the literal example admin key straight out of the documentation.

1. The Key Everyone Was Told to Change

LiteLLM is an open-source AI gateway—software that sits between applications and the various AI model providers they call, routing requests and managing the credentials needed to reach those providers.

Its setup guide includes an example master key, sk-1234, positioned directly above a comment instructing operators to replace it before deploying to production.

That comment exists precisely because the master key isn't decorative—it functions as both the administrator credential and the authentication switch for the entire gateway.

2. What an AI Gateway Actually Guards

It's worth being direct about what sits behind that key, because "AI gateway" undersells how sensitive this piece of infrastructure actually is.

A properly configured LiteLLM instance can hold model provider API keys used by an organization. Depending on the deployment, the gateway may also have access to cloud IAM credentials, internal tools through the Model Context Protocol (MCP), and prompts and responses passing through the system.

That makes an AI gateway a concentration point for exactly the kind of credentials and data an attacker wants to obtain.

3. The Numbers Wiz Research Found

Wiz Research scanned internet-facing LiteLLM instances via Shodan, identifying 3,074 exposed gateways in an initial pass in February 2026, followed by another scan in August 2026.

Of those, 294 gateways—roughly 9.6%—accepted the unmodified example key, sk-1234, as valid administrator credentials.

A further 191 instances had no key configured at all, meaning effectively any credential offered could be accepted.

Combined, that's a meaningful share of publicly reachable AI infrastructure standing effectively unlocked.

4. What "sk-1234" Actually Unlocks

Successfully authenticating with the default key can provide an attacker with access to sensitive resources associated with the gateway.

Depending on the deployment, this can include:

• Model provider API keys stored on the gateway
• Cloud IAM credentials available to the host
• Internal tools reachable through MCP
• Prompts and responses passing through the gateway
• Potentially proprietary code and business information
• Customer or organizational data included in AI prompts

The impact depends heavily on how the organization configured the gateway and what permissions were granted to the underlying infrastructure.

5. This Wasn't the Only Way In

The default-key issue sits alongside several vulnerabilities in the same ecosystem, which Wiz's research ties together as part of the broader risk picture.

CVE-2026-59822 allows unauthenticated MCP access and was added to CISA's Known Exploited Vulnerabilities catalog on September 2, 2026.

CVE-2026-42271 permits authenticated command execution and has reportedly been observed in the wild installing cryptocurrency miners on compromised gateways.

CVE-2026-48710, a flaw in Starlette, enables credentialless exploitation.

Together with the default-key problem, these issues demonstrate why AI gateways need to be treated as security-critical infrastructure rather than ordinary routing software.

6. Why "Tier-0 Secrets Store" Is the Right Way to Think About This

Microsoft's assessment of this class of risk is worth highlighting: "Treat AI gateways as Tier-0 secrets stores."

That framing matters because many teams still mentally categorize an AI gateway as routing infrastructure—a convenience layer that is not fundamentally different from a load balancer.

In practice, an AI gateway can hold the same category of sensitive material as a credential vault or identity provider.

It therefore needs strong access control, monitoring, credential management, network restrictions, and disciplined default-configuration practices.

7. Fixing It—Today, Not After an Upgrade Window

The remediation guidance is actionable without waiting for a maintenance window.

Changing the master key from sk-1234 to a long, randomly generated value requires no software upgrade. It is a configuration change that should be made immediately.

Organizations should also:

• Upgrade to a patched LiteLLM release where applicable.
• Block unnecessary /mcp/ endpoints at the API gateway layer.
• Restrict guardrails endpoints to administrators.
• Review and tighten pass-through endpoints.
• Restrict outbound network access where possible.
• Use minimal cloud IAM permissions.
• Rotate credentials if compromise is suspected.
• Review gateway configuration and logs for suspicious activity.
• Restart affected processes after remediation where appropriate.

The goal should not simply be to patch one vulnerability. The larger objective is to reduce the blast radius if the gateway is ever compromised.

8. Why Smart Engineers Still Ship the Example Value

It's tempting to read a statistic like "1 in 10" as a story about carelessness, but the more useful interpretation is structural.

Example credentials in documentation exist to get a system running quickly during initial setup. That's precisely the moment when a team is focused on making something work rather than thinking about production hardening.

The gap between "it works" and "it's actually secured for the internet" is where defaults like sk-1234 quietly survive past the point they were ever meant to.

That's not a reason to excuse the mistake. Instead, it demonstrates why deliberate security review processes are important before infrastructure reaches production.

9. Build These Skills—Innovative Academy

Properly securing API gateways, managing credentials across cloud infrastructure, and auditing default configurations before anything reaches production are core DevOps disciplines—not specialist security add-ons.

Innovative Academy's AWS DevOps Training in Bangalore focuses on practical cloud and DevOps skills, including infrastructure, automation, cloud access management, and security-oriented practices through hands-on learning.

For aspiring DevOps and cloud professionals, learning how to identify insecure defaults, manage credentials correctly, apply least-privilege access, and secure production infrastructure can make a significant difference in real-world environments.

10. Final Thoughts

What makes this LiteLLM finding worth remembering isn't any clever exploit technique—there isn't one.

It's a documentation example that a meaningful share of real, internet-facing deployments simply never got around to changing.

That's about as unglamorous a root cause as security research turns up, and that's precisely why it's worth taking seriously.

Sophisticated attacks get headlines, but many real-world compromises trace back to overlooked and preventable gaps between what a setup guide recommends and what actually ships to production.

For anyone building a career in DevOps or cloud infrastructure, the practical lesson is simple: treat every default value in every piece of infrastructure—API keys, database passwords, admin credentials—as a checklist item that gets explicitly verified before go-live.

With more sensitive data and credentials flowing through AI gateways, that discipline matters more with each new AI-integrated system organizations deploy.