Advisory · CVE-2026-117574
Cross-tenant LLM API key injection in Red Hat OpenShift AI gateway
An authenticated attacker can make the OpenShift AI gateway inject another tenant's API keys into requests, letting them spend the victim tenant's LLM quota. Red Hat rates it critical at CVSS 9.1.
- Vendor
- Red Hat
- Product
- Red Hat OpenShift AI
- Identifier / CWE
- CVE-2026-117574
CWE-639 - Action timing
- Immediate
Explain it like I’m five
The gateway hands out API keys from a shared drawer without checking whose drawer it opened. An attacker just names another tenant's model and gets that tenant's keys slipped into the request.
- 01Tenant model identifier
An authenticated remote attacker submits a request naming another tenant's model identifier in the body or header.
- 02Missing authorization check
The service retrieves credentials from the shared store without verifying authorization.
- 03Key injection
The target tenant's API keys are injected into the request.
- 04Victim quota spent
The attacker makes unauthorized requests and consumes the victim tenant's LLM resources and quotas.
What happened
Red Hat disclosed a flaw in ai-gateway-payload-processing in Red Hat OpenShift AI. An authenticated remote attacker can exploit it by submitting a request specifying another tenant’s model identifier in the request body or header. Because the service does not verify authorization before retrieving credentials from the shared store, it injects the target tenant’s API keys into the request. Red Hat rates it critical at CVSS 3.1 9.1.
The stated impact is unauthorized requests plus consumption of another tenant’s LLM resources and quotas. The NVD record does not state fixed versions, so teams should follow the Red Hat advisory for the corrected component rather than assuming a version.
What to do
- Inventory Red Hat OpenShift AI deployments using the AI gateway payload processing component.
- Apply the fix from the Red Hat advisory.
- Restrict gateway access to trusted tenants while remediation is underway.
- Review gateway logs for requests naming model identifiers belonging to other tenants.
- Rotate API keys for any tenant whose credentials may have been injected into attacker requests.
- Confirm the deployed component version after patching.
Management note
Cross-tenant key leakage breaks the core promise of a shared AI platform: one tenant’s spend becomes another tenant’s attack surface. Treat key rotation as part of the fix, not an optional extra.