LiteLLM Proxy Grants PROXY_ADMIN Without Master Key/Auth

Arnold Chan@slaz

•updated Sep 12, 2026•0•0•1

Detects requests to a LiteLLM proxy that have been assigned the 'PROXY_ADMIN' role despite the absence of valid authentication credentials (Authorization headers, JWT tokens, or OAuth2 tokens). This pattern typically indicates that the LiteLLM instance is misconfigured, specifically that a 'master_key' is missing, causing the proxy to default to a permissive mode where every request is treated as having administrative privileges.