One unauthenticated request to LiteLLM's admin endpoint dumps every provider key the proxy routes

LiteLLM exists to hold the keys. It sits between applications and providers, managing keys, rate limits and model routing ^[6], so its configuration file is the union of every provider credential in the deployment. The dev.to post says a single unauthenticated request to the admin panel dumps every provider key the proxy knows about, naming OpenAI, Anthropic, Azure and Cohere ^[7]. KEV placement raises the prior: by CISA's definition, every entry has evidence of exploitation against real targets ^[3].

The Kestra and Starlette paths end at the same file. Once an attacker has code execution, the post says the first thing read is /proc/1/environ, which holds every environment variable set when the container's init process started, and for AI infrastructure that almost always includes API keys ^[11]. The sample dump in the post lists OPENAI_API_KEY, ANTHROPIC_API_KEY, LITELLM_MASTER_KEY, a Postgres DATABASE_URL with the password inline, and AWS access keys ^[12]. The post calls that output "not a hypothetical output" and says it is what researchers "consistently find" in lab environments that mirror real deployments ^[13].

The keys are in the environment because the documentation put them there. The LiteLLM quickstart tells you to export your API keys as environment variables, and so does the RAGFlow setup guide and every Ollama plus Open WebUI tutorial on YouTube ^[14]. Compose files and Kubernetes manifests pass secrets the same way, for the same reason ^[15].

Starlette is the ASGI layer under FastAPI, which the post puts at roughly 70 percent of self-hosted AI model servers ^[10]. Before that share says anything about your box, the number would have to come from a measured population of servers, and the SSRF would have to be reachable from a route your application exposes.

None of the default configurations the post lists require authentication, and discovery is a Shodan or Censys sweep for those ports ^[18]. Three of the seven CVEs added that week land in this stack, about 43 percent of the batch ^[21], alongside SonicWall SMA 1000 appliances, Sangoma Switchvox and JFrog Artifactory ^[4]. The post does not give the CVE identifiers or fixed versions, so version mapping means reading CISA's catalog entries directly ^[20].

Persistence is an SSH public key in authorized_keys, a cron job or a reverse shell, which the post itself describes as standard post-exploitation with nothing AI-specific about it ^[19]. The post draws one comparison worth repeating: SonicWall admins know they are running critical infrastructure, and most people running LiteLLM do not ^[22].