Live › vulnerability › CVE-2026-117574
Go to dashboardAn authenticated user can name another tenant's model in a request, and the gateway injects that tenant's LLM API keys into the request without an authorization check. The attacker can make calls billed to and drawn from another tenant's model quotas.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 20:35 UTC. All times on this page are UTC.
Multi-tenant deployments of the ai-gateway-payload-processing service where tenants share a credential store for LLM provider keys. Single-tenant deployments, or setups where the gateway does not hold other tenants' keys, are less exposed. The sources do not say which versions or configurations are affected.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A flaw was found in ai-gateway-payload-processing. An authenticated remote attacker can exploit this vulnerability by submitting a request specifying another tenant's model identifier in the request body or header. Because the service does not verify authorization before retrieving credentials from the shared store, it injects the target tenant's application programming interface (API) keys into the request. This flaw allows an attacker to perform unauthorized requests and consume another tenant's large language model (LLM) resources and quotas.
This page as .md · .json · in your agent: get_signal("CVE-2026-117574")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.