Whoever holds a LiteLLM master key reads every provider key and the host's IAM credentials

Subtract the 191 gateways that had no master key at all, and the documented value was in place on 103 of the 294 that answered, which is 3.4 percent of the 3,074 scanned ^[2][3][2]. The other 65 percent of the accepting set had nothing to guess ^[3]. The distinction decides which repair helps. Rewriting the setup guide covers the smaller share; the rest comes from a design choice, because the master key is both the admin credential and the switch that turns authentication on, so a gateway that starts without one granted full admin rights to every inbound request before 1.82.0-stable ^[9][10].

Administrator is the whole gateway. It can reach internal tools over the Model Context Protocol ^[11], and it usually inherits the cloud permissions of the workload it runs in ^[12]. An admin can also create a pass-through route that forwards requests to any URL, and the target is not checked against localhost, private address ranges, or the instance metadata service ^[14]. IMDSv2 does not close that door, because LiteLLM forwards any header carrying an x-pass- prefix with the prefix removed, which is how Wiz supplied the token headers IMDSv2 requires ^[15]. That chain has no CVE and no fix. Wiz's own reading is that the feature is arguably working as intended, since the project's threat model treats administrators as trusted ^[17], and no one has reported it used against a live deployment ^[16].

The version floor is the part worth checking. Both descriptions of CVE-2026-59821 concern the guardrail create and update endpoints, which skipped the sandbox and pattern checks before 1.82.0-stable and would run submitted Python inside the container ^[21]. Wiz's report says that after 1.82.0 an attacker with the default key is confined to a sandbox ^[23]. LiteLLM's own advisory from May, CVE-2026-40217, says that sandbox could be escaped with bytecode techniques by running code in the proxy process, which the advisory notes runs as root in the default Docker image, across versions from 1.81.8 up to but not including 1.83.10, reachable with a proxy-admin credential ^[24][25]. The master key is that credential ^[25]. For a gateway whose key is printed in the documentation, the fixed release is 1.83.10, not 1.82.0 ^[4].

Whether any of this improved since February is not knowable from the published data. A second scan in August returned more than 85,000 instances, but Wiz assesses most as honeypots or test systems, so it is not comparable to the 3,074 and there is no current figure ^[7]. What is known is that the guide still shipped sk-1234 on September 9, roughly seven months after the scan, above the comment telling operators to replace it with a long random value ^[8][5]. Rotating that key needs no upgrade and removes every step in Wiz's report that depends on holding it ^[6].