CVE-2026-117574

OpenShift AI gateway can select another tenant's provider credentials

Red Hat · OpenShift AI ai-gateway-payload-processing

First documented disclosure · Review checkpoint

Summary

An authenticated gateway caller can consume another project's LLM resources and quota.

Severity and exploitation evidence

Critical · 9.1/10 · CVSS 3.1. Severity source.

Exploitation not established: The vendor confirms the authorization flaw; its sources do not establish malicious exploitation or a confirmed compromise.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Client-controlled model or tenant selection reaches a shared credential store without an in-process authorization check; the gateway injects the selected tenant's API credentials into the downstream request.

Conditions required

Valid credentials for a multi-tenant OpenShift AI gateway and knowledge or selection of another tenant's model identifier.

Potential impact

Unauthorized use of another tenant's provider credentials and compute quota. Direct return of raw keys to the caller is not established by the reviewed description.

Affected versions and configurations

Red Hat marks rhoai/odh-ai-gateway-payload-processing-rhel9 affected without a numeric version range; its e2e-rhel9 package is marked not affected.

Fix and mitigation status

No fixed version or erratum is provided in the reviewed Red Hat record.

Practical next steps

Restrict gateway access, enforce tenant authorization before credential lookup and avoid shared credentials across projects; track Red Hat's issue-specific remediation.

Operating lesson

Authenticate the caller and authorize the selected tenant before attaching provider credentials.

Evidence and limits

Red Hat dates public disclosure October 27 and the CNA was published October 28. The CVSS 3.1 score 9.1 is marked draft in Red Hat's API; the vendor's qualitative severity is Important. The title refers to URL-path selection while the detailed description says body/header model identifiers; both indicate missing authorization, and no single exact input path is asserted here.

Sources