PrivacyHigh
CVE-2026-117574: A flaw was found in ai-gateway-payload-processing. An authenticated remote attacker can exploit this…
- Occurred
- Oct 28, 2026
- Published
- Oct 28, 2026
- Source
- NVD CVE
Summary
A flaw was found in ai-gateway-payload-processing. An authenticated remote attacker can exploit this vulnerability by submitting a request specifying another tenant's model identifier in the request body or header. Because the service does not verify authorization before retrieving credentials from the shared store, it injects the target tenant's application programming interface (API) keys into the request. This flaw allows an attacker to perform unauthorized requests and consume another tenant's large language model (LLM) resources and quotas.
Tags
- CVE
- CVE-2026-117574
- cvss:CRITICAL
Classification
Category confidence: 90%
Severity confidence: 85%
Rationale: Unauthorized access to another tenant's API keys and LLM resources constitutes a significant privacy and security breach.
Classifier: Qwen/Qwen3.5-35B-A3B-FP8