On this page (7 sections)
CVE-2026-117574 is a critical flaw in ai-gateway-payload-processing, a service that sits in front of large language model (LLM) providers. According to the GitHub Advisory Database entry, an authenticated remote attacker can name another tenant's model identifier in a request and cause the service to attach that tenant's API keys to the request.
If you run or depend on a shared, multi-tenant AI gateway, this matters to you. The advisory does not yet list affected or patched versions, so the practical work right now is working out whether you use this component and limiting what a stolen or misused key can do.
What happened
The advisory was published on October 28, 2026 and describes a missing authorization check. A caller who is logged in as one tenant can submit a request that specifies a different tenant's model identifier, either in the request body or in a header. The service then fetches credentials from a shared store without first asking whether the caller is allowed to use them.
The result, per the advisory, is that the target tenant's API keys are injected into the attacker's request. The attacker can then make unauthorized requests and consume the other tenant's LLM resources and quotas.
Technical details
The weakness class is CWE-639. In plain terms: the system uses an identifier supplied by the user (here, a model identifier) to look up something sensitive (credentials), and never checks that the user owns it. Security teams often call this an insecure direct object reference. The fix for this class is always the same idea: derive the tenant from the authenticated session, not from what the request claims, and check ownership before any lookup.
The CVSS v3.1 vector in the advisory is AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L. Read simply:
- Network attack vector, low complexity: it can be attempted remotely without special conditions.
- Low privileges required: the attacker needs a valid account, but not an administrative one.
- No user interaction needed.
- Scope changed: the impact reaches beyond the vulnerable component into another tenant's resources.
- High confidentiality impact, low integrity and availability impact.
The advisory describes the impact as unauthorized use of another tenant's LLM resources and quotas. It does not state that keys are returned to the attacker in a response, and it does not describe any other consequence, so avoid assuming more than that.
Who is affected
Exposure depends on a combination of things, based on the advisory's description:
- You run ai-gateway-payload-processing, or a product that bundles it, as a gateway shared by more than one tenant, team or customer.
- Credentials for multiple tenants live in a shared store the gateway reads from.
- Attackers, including a malicious or compromised tenant account, can authenticate to the gateway.
A single-tenant deployment has no other tenant to impersonate, though a shared key store is still worth reviewing. Agencies and platform teams that resell or share LLM access across clients are the most realistic targets, since the practical damage is cost, quota exhaustion and misuse of one client's provider account.
How to check your exposure
Because no affected versions are published, start by finding out whether the component is in your stack at all. The commands below are read-only. Run them on the host or in the project that deploys your gateway.
grep -ril "ai-gateway-payload-processing" . 2>/dev/nullAny file listed shows where the component is referenced, such as a manifest, lockfile or configuration. If you run containers, check the image names and labels your orchestrator reports for the same string.
grep -i "model" /path/to/gateway/access.log | lessLook for tenants requesting model identifiers that belong to other tenants, and for sudden usage from accounts that normally send little traffic. The log format depends on your deployment, so treat this as a starting point rather than a definitive detector.
Also review your LLM provider dashboards. Unexpected spikes in usage, spend or rate-limit errors on one tenant's key are the most visible sign of someone else consuming that quota.
What to do now
No fixed version is named in the advisory, so patching guidance cannot be given yet. Watch the GitHub advisory, the Red Hat CVE page and the Red Hat Bugzilla entry for vendor updates, and apply a fix as soon as one is released.
0 of 8 done
Detection and monitoring afterwards
Treat this as an ongoing watch rather than a one-time check. Track per-tenant token usage and cost daily, and alert on sharp changes. Keep logs long enough to look back after a fix lands, since the advisory gives no exploitation timeline.
If your gateway is reachable from the internet, it is worth knowing what else is exposed on the same hosts. A read-only Webforta Scan of a site you verify can surface outdated components and exposed services, and certificate and header-change monitoring helps you notice unexpected changes. Neither can tell you whether this specific flaw is present in an internal service.
For background on the broader practice, see our guide to small business website security.
What is still unknown
- Which versions of ai-gateway-payload-processing are affected.
- Whether a patched version exists.
- Whether the flaw has been exploited in the wild. The research reports no exploitation, and the advisory's EPSS estimate is 0.236%, but that is a probability estimate, not a confirmation either way.
- Whether workarounds exist beyond general access and key hygiene.
This article will need updating when the vendor publishes fixed versions or more detail.
Sources
This article is based on the public sources below. Details can change as vendors and researchers publish more; check the original advisories before acting on version numbers.