litellm - 💡(How to fix) Fix CRITICAL (CVSS 9.8): Master API key defaults to sk-1234 — full AI Gateway compromise

CWE-798: Master API Key Defaults to sk-1234 — Full Gateway Compromise (CVSS 9.8)

Severity: CRITICAL (CVSS 9.8)

Location

.env.example and docker-compose.yml

Summary

LiteLLM, an AI Gateway used by enterprises to route requests to 100+ LLM providers (OpenAI, Anthropic, Azure, Bedrock, Vertex), ships with LITELLM_MASTER_KEY=sk-1234 as the default. This key grants full PROXY_ADMIN access.

Impact

With sk-1234, an attacker can:

• Generate unlimited API keys
• Read all stored provider credentials (OpenAI, Anthropic, Azure, etc.)
• Make inference calls on any configured provider (billed to the victim)
• Access full spend logs including raw prompts and responses
• Create admin users, modify routing rules, delete models

Proof of Concept

curl -H "Authorization: Bearer sk-1234" http://TARGET:4000/health → 200 OK
curl -H "Authorization: Bearer sk-1234" http://TARGET:4000/v1/models → Full model list
curl -X POST -H "Authorization: Bearer sk-1234" http://TARGET:4000/key/generate → Generates admin keys

Affected Versions

1.86.0 (latest as of 2026-05-25) and all prior versions. The test suite has used sk-1234 since the project's inception.

Remediation

1. Replace default with empty string requiring explicit configuration
2. Add startup validation that rejects known default keys
3. Generate a random master key on first boot if not configured
4. Add prominent documentation warning