LiteLLM漏洞評測：預設金鑰sk-1234害近一成閘道淪陷 | LiteLLM Flaw: sk-1234 Admin Key Hits 10% of Gateways

9月 11, 2026

By Kit 小克 | AI Tool Observer | 2026-09-11

🇹🇼 LiteLLM漏洞評測：預設金鑰sk-1234害近一成閘道淪陷

開源 AI Gateway LiteLLM 這週登上資安圈頭條：資安公司 Wiz 掃描網路上對外開放的 LiteLLM 閘道後發現，近一成（9.6%）直接吃官方設定教學裡寫死的範例金鑰 sk-1234，等於任何人不用密碼就能拿到管理員權限。LiteLLM 是 GitHub 星數破 4.8 萬的熱門專案，負責在你的應用程式和 OpenAI、Anthropic 等模型供應商之間做流量閘道，一旦這把鑰匙外洩，等於把整個 AI 基礎設施的大門直接打開給陌生人。

sk-1234 這把鑰匙能打開什麼

拿到 LiteLLM 的管理員金鑰，攻擊者能讀出閘道上存的每一組模型供應商 API 金鑰、看到所有通過閘道的 prompt 與回覆內容，還能透過 MCP（Model Context Protocol）連進企業內部工具。Wiz 的測試更進一步證實，這把金鑰甚至能一路挖到閘道所在雲端主機的 IAM 憑證，也就是說，一個範例金鑰沒改，可能連累到整個雲端帳號。

Wiz 掃描出的數字有多嚴重

2 月掃描 Shodan，找到 3,074 台對外開放的 LiteLLM 閘道
其中 294 台（9.6%）直接吃預設金鑰 sk-1234
191 台（6.2%）根本沒開任何驗證，門完全沒鎖
漏洞被列為 CVSS 9.8 分，屬於極高風險等級
已觀察到駭客在野外掃描、嘗試 sk-litellm-master-key 等常見金鑰、建立管理員帳號、刪除模型設定

該不該用 LiteLLM：誠實地說

LiteLLM 工具本身沒問題，問題出在「照抄文件範例值直接上生產環境」這個老掉牙的坑，跟多年前沒設密碼就對外開放的 MongoDB、Redis 一模一樣。如果你的團隊已經在用 LiteLLM，現在該做的事很明確：立刻把 master key 換成隨機長字串、升級到官方修補版本 1.83.0 以上、絕對不要把管理介面直接暴露在公網、定期用 Shodan 或內部工具掃描確認閘道沒有裸奔。AI 閘道握有所有模型金鑰和內部工具連線權限,安全等級不該低於資料庫。

好不好用，試了才知道。

🇺🇸 LiteLLM Flaw: sk-1234 Admin Key Hits 10% of Gateways

The open-source AI gateway LiteLLM made security headlines this week after researchers at Wiz scanned internet-facing LiteLLM gateways and found that nearly 1 in 10 (9.6%) still accepted sk-1234 — the literal example admin key printed in LiteLLM's own setup docs. LiteLLM is a popular project with over 48,000 GitHub stars, sitting between applications and model providers like OpenAI and Anthropic to route API traffic. Leave that example key unchanged, and you've handed a stranger the front door to your entire AI stack.

What sk-1234 Actually Unlocks

Anyone holding LiteLLM's admin key can read every provider API key stored on the gateway, see every prompt and response flowing through it, and reach internal tools connected via MCP (Model Context Protocol). Wiz's tests went further: the same key led to the cloud IAM credentials of the host machine itself. One unchanged example key can cascade into a full cloud account compromise.

How Bad Is the Exposure?

A February Shodan scan turned up 3,074 internet-facing LiteLLM gateways
294 instances (9.6%) accepted the default sk-1234 key outright
191 instances (6.2%) had no authentication enabled at all
The flaw carries a CVSS score of 9.8 — critical severity
Attackers are already scanning for it in the wild, guessing keys like sk-litellm-master-key, creating admin accounts, and deleting model configs

Should You Still Use LiteLLM? Honestly, Yes — But Fix This First

LiteLLM the tool isn't the problem; the problem is the same decades-old mistake of copying a docs example straight into production — the same class of error as an internet-facing MongoDB or Redis instance with no password. If your team runs LiteLLM, the fix list is short and non-negotiable: rotate the master key to a long random value immediately, upgrade to version 1.83.0 or later, never expose the admin interface directly to the public internet, and periodically scan your own perimeter the way Wiz did. An AI gateway holds every model key and internal tool connection you have — it deserves at least the same security bar as a database.

好不好用，試了才知道。(Only real use will tell.)

Sources / 資料來源

延伸閱讀 / Related Articles

AI 工具觀察站 — 每日精選 AI Agent 與工具趨勢
AI Tool Observer — Daily curated AI Agent & tool trends

搜尋此網誌

AI小貼士