Authorization Flaw in ai-gateway-payload-processing Affects Red Hat Products
CVE-2026-117574

9.1CRITICAL

Key Information:

Vendor

Red Hat
Status
Red Hat Openshift Ai (rhoai)
Vendor
CVE Published:
28 October 2026

What is CVE-2026-117574?

A vulnerability exists in ai-gateway-payload-processing, allowing an authenticated remote attacker to exploit the system by crafting a request that includes a different tenant's model identifier. The service fails to validate authorization before accessing credentials stored in a shared location, leading to the unauthorized injection of the targeted tenant's application programming interface (API) keys. This exploitation permits attackers to make unauthorized requests, thereby utilizing the resources and quotas associated with another tenant's large language model.

References

https://access.redhat.com/security/cve/CVE-2026-117574
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2494861
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.