---
id: "CVE-2026-117574"
kind: "vulnerability"
aliases: ["CVE-2026-117574"]
title: "ai-gateway-payload-processing: tenants can use other tenants' LLM API keys"
severity: "critical"
cvss: 9.1
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: []
ecosystems: []
tags: ["ai-gateway", "ai-tooling", "llm", "multi-tenant", "self-hosted"]
not_affected_if: ["no-shared-credential-store", "single-tenant"]
published_at: "2026-10-28T20:17:21+00:00"
first_seen_at: "2026-10-28T20:35:10+00:00"
updated_at: "2026-10-28T20:36:05+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-117574", "first_seen_at": "2026-10-28T20:35:10+00:00"}]
---

# ai-gateway-payload-processing: tenants can use other tenants' LLM API keys

An authenticated user can name another tenant's model in a request, and the gateway injects that tenant's LLM API keys into the request without an authorization check. The attacker can make calls billed to and drawn from another tenant's model quotas.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Confirm whether the deployment runs ai-gateway-payload-processing (unknown from sources which versions are affected)
- Check whether the gateway stores per-tenant provider API keys in a shared credential store
- unknown whether a specific version or config string identifies the vulnerable code

## Fix

- unknown: the sources do not name a patched version or a vendor fix
- Until a fix is available, restrict who can send requests through the gateway and rotate any provider API keys held in the shared store

## Timeline

- 2026-10-28T20:35:10+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-117574

## From the sources

A flaw was found in ai-gateway-payload-processing. An authenticated remote attacker can exploit this vulnerability by submitting a request specifying another tenant's model identifier in the request body or header. Because the service does not verify authorization before retrieving credentials from the shared store, it injects the target tenant's application programming interface (API) keys into the request. This flaw allows an attacker to perform unauthorized requests and consume another tenant's large language model (LLM) resources and quotas.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_