{"id":"CVE-2026-117574","kind":"vulnerability","aliases":["CVE-2026-117574"],"related":[],"title":"ai-gateway-payload-processing: tenants can use other tenants' LLM API keys","description":"A flaw was found in ai-gateway-payload-processing. An authenticated remote attacker can exploit this vulnerability by submitting a request specifying another tenant's model identifier in the request body or header. Because the service does not verify authorization before retrieving credentials from the shared store, it injects the target tenant's application programming interface (API) keys into the request. This flaw allows an attacker to perform unauthorized requests and consume another tenant's large language model (LLM) resources and quotas.","summary":"An authenticated user can name another tenant's model in a request, and the gateway injects that tenant's LLM API keys into the request without an authorization check. The attacker can make calls billed to and drawn from another tenant's model quotas.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-gateway","ai-tooling","llm","multi-tenant","self-hosted"],"not_affected_if":["no-shared-credential-store","single-tenant"],"how_to_check":"- Confirm whether the deployment runs ai-gateway-payload-processing (unknown from sources which versions are affected)\n- Check whether the gateway stores per-tenant provider API keys in a shared credential store\n- unknown whether a specific version or config string identifies the vulnerable code","fix":"- unknown: the sources do not name a patched version or a vendor fix\n- Until a fix is available, restrict who can send requests through the gateway and rotate any provider API keys held in the shared store","status":"open","published_at":"2026-10-28T20:17:21+00:00","first_seen_at":"2026-10-28T20:35:10+00:00","triaged_at":"2026-10-28T20:36:05+00:00","updated_at":"2026-10-28T20:36:05+00:00","category":"ai-tooling","confidence":0.6,"triage":{"at":"2026-10-28T20:36:05Z","model":"claude-haiku-5-5","output":{"fix":"- unknown: the sources do not name a patched version or a vendor fix\n- Until a fix is available, restrict who can send requests through the gateway and rotate any provider API keys held in the shared store","reach":"internet","title":"ai-gateway-payload-processing: tenants can use other tenants' LLM API keys","impact":"high","summary":"An authenticated user can name another tenant's model in a request, and the gateway injects that tenant's LLM API keys into the request without an authorization check. The attacker can make calls billed to and drawn from another tenant's model quotas.","category":"ai-tooling","nicknames":[],"who_cares":["ai-gateway","multi-tenant","llm","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker consumes other tenants' LLM quotas using their injected API keys.","analyst_note":"Find the vendor advisory or project commit for ai-gateway-payload-processing to get affected and fixed versions and config details; the NVD entry alone gives none.","how_to_check":"- Confirm whether the deployment runs ai-gateway-payload-processing (unknown from sources which versions are affected)\n- Check whether the gateway stores per-tenant provider API keys in a shared credential store\n- unknown whether a specific version or config string identifies the vulnerable code","needs_analyst":true,"not_affected_if":["single-tenant","no-shared-credential-store"],"who_is_affected":"Multi-tenant deployments of the ai-gateway-payload-processing service where tenants share a credential store for LLM provider keys. Single-tenant deployments, or setups where the gateway does not hold other tenants' keys, are less exposed. The sources do not say which versions or configurations are affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000652,"input_tokens":3355,"output_tokens":633,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-117574':16A,19A '-2026':15A,18A 'ai':2A,21B,24B,83C 'ai-gateway':20B 'ai-gateway-payload-process':1A,82C 'ai-tool':23B 'allow':141C 'anoth':38B,72B,100C,150C 'api':12A,53B,134C 'applic':131C 'attack':63B,90C,143C 'authent':34B,88C 'author':60B,117C 'bill':67B 'bodi':108C 'call':66B 'check':61B 'consum':149C 'credenti':120C 'cve':14A,17A 'drawn':70B 'exploit':92C 'flaw':78C,140C 'found':80C 'gateway':3A,22B,47B,84C 'header':110C 'host':32B 'identifi':104C 'inject':48B,126C 'interfac':133C 'key':13A,54B,135C 'languag':154C 'larg':153C 'llm':11A,26B,52B,156C 'make':65B 'model':41B,75B,103C,155C 'multi':28B 'multi-ten':27B 'name':37B 'payload':4A,85C 'perform':145C 'process':5A,86C 'program':132C 'quota':76B,159C 'remot':89C 'request':44B,57B,98C,107C,138C,147C 'resourc':157C 'retriev':119C 'self':31B 'self-host':30B 'servic':113C 'share':123C 'specifi':99C 'store':124C 'submit':96C 'target':128C 'tenant':6A,10A,29B,39B,50B,73B,101C,129C,151C 'tool':25B 'unauthor':146C 'use':8A 'user':35B 'verifi':116C 'vulner':94C 'without':58B","nicknames":[],"mitigations":[],"who_affected":"Multi-tenant deployments of the ai-gateway-payload-processing service where tenants share a credential store for LLM provider keys. Single-tenant deployments, or setups where the gateway does not hold other tenants' keys, are less exposed. The sources do not say which versions or configurations are affected.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T20:17:21+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117574","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117574","severity":null,"published_at":"2026-10-28T20:17:21+00:00","modified_at":"2026-10-28T20:17:21+00:00","first_seen_at":"2026-10-28T20:35:10+00:00","fetched_at":"2026-10-28T20:35:10+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}