Default AI Gateway Keys Left Millions of Servers Exposed

Security researchers from Wiz discovered that a significant portion of internet-facing AI gateways remain vulnerable due to the use of default credentials. By scanning over 3,000 instances in February, they found that 294 servers accepted a simple placeholder key, effectively handing over administrative control to anyone who tried it.

This is not a minor configuration error. LiteLLM, the open-source software involved, acts as a bridge between applications and AI model providers. The key in question is the master administrator credential, meaning its compromise exposes every API key stored on the server and allows access to sensitive cloud infrastructure.

The Scope of the Exposure

The vulnerability stems from a common practice: leaving example values in place. According to The Hacker News, the issue persists because many operators deploy software without changing the initial setup. In 191 of the compromised cases, no key was set at all, while the rest retained the default value from the official documentation.

A subsequent scan in August detected over 85,000 instances, though researchers caution that many are likely test systems or decoys. Consequently, there is no precise current count of vulnerable systems. The core problem remains that the default key is still documented in the setup guide, creating a persistent risk for those who do not update their configurations.

Access Beyond the Gateway

Holding the master key grants more than just access to AI models. It allows an attacker to view every prompt and response passing through the system. More critically, it enables access to internal tools and cloud permissions. This means an intruder can potentially execute workloads that bill the victim’s account, a tactic known as LLMjacking.

The risk extends further through a feature called pass-through endpoints. This allows administrators to route requests to any URL. Because the system does not block private or internal addresses, an attacker can point these routes at cloud metadata services. This action reveals the identity credentials of the machine running the gateway, effectively bridging the gap between the AI application and the underlying cloud infrastructure.

Disputed Severity and Mitigation

The severity of these findings is a point of contention. Wiz classifies a specific code execution flaw as high-risk, noting it allows root-level access. In contrast, the LiteLLM maintainers rate the same issue as low severity, arguing it requires high-privilege access to exploit. Both agree, however, that the underlying cause is the lack of proper authentication setup.

The fix is straightforward but must be actively implemented. Operators must replace the default key with a unique, random string. This single step closes the administrative access path and prevents the exploitation of the pass-through features. Until this change is made, the gateway remains open to anyone who knows the placeholder value.