EUVD-2026-43310
GHSA-fgpg-f5rm-p28p
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Disclosure requires authorized read access to logs, so PR:L and AV:L rather than network/unauthenticated; confidentiality-only impact means I:N and A:N.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
2DescriptionCVE.org
A flaw was found in the vllm-orchestrator-gateway component. The system's production binary logs all incoming authorization headers and full chat payloads, which may contain personally identifiable information (PII) and secrets, to persistent logs. This sensitive data, including bearer tokens and chat content, can be accessed by any user with logging privileges. This vulnerability leads to information disclosure, potentially allowing an attacker to harvest credentials and sensitive conversation content.
AnalysisAI
Sensitive information disclosure in Red Hat OpenShift AI's vllm-orchestrator-gateway component exposes bearer tokens and full chat payloads because the production binary writes all incoming Authorization headers and complete request bodies to persistent logs. Any user holding logging privileges can read these logs to harvest live credentials and potentially PII-laden conversation content. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Technical ContextAI
The affected component, vllm-orchestrator-gateway, is a routing/orchestration gateway that fronts vLLM model-serving endpoints within Red Hat OpenShift AI (RHOAI), per CPE cpe:2.3:a:red_hat:red_hat_openshift_ai_(rhoai). The root cause is CWE-538 (Insertion of Sensitive Information into an Externally Accessible File or Directory): the gateway's logging path emits the raw HTTP Authorization header (bearer tokens used to authenticate to the LLM API) and the entire chat request payload at a verbosity that persists to durable log storage. In a Kubernetes/OpenShift context these logs are typically aggregated (e.g., to container stdout, EFK/Loki stacks, or persistent volumes) and become readable by operators, log-pipeline service accounts, or anyone granted namespace/cluster log-viewing RBAC - widening the effective audience of secrets far beyond the API caller.
RemediationAI
No vendor-released patch version is identified in the available data; monitor the Red Hat advisory (https://access.redhat.com/security/cve/CVE-2026-15574) and Bugzilla 2499594 (https://bugzilla.redhat.com/show_bug.cgi?id=2499594) for the fixing errata and apply it once published. As immediate compensating controls: lower the gateway's log verbosity or disable request/header logging so Authorization headers and chat bodies are no longer emitted (trade-off: reduced request-level observability for debugging); tighten RBAC on OpenShift log viewing and the aggregation backend (Loki/EFK/persistent volumes) to the minimum set of operators (trade-off: on-call staff may lose self-service log access); scrub or redact existing persisted logs that already contain tokens; and, because leaked bearer tokens must be treated as compromised, rotate/revoke any tokens that may have been written to logs and shorten token TTLs going forward.
More in Red Hat Openshift Ai Rhoai
View allThe Feast Feature Server contains a path traversal vulnerability in its `/read-document` endpoint that allows unauthenti
Unauthenticated remote code execution affects Feast (the open-source ML feature store), where user-defined functions sto
Authentication bypass in the Models-as-a-Service (MaaS) API component of Red Hat OpenShift AI (RHOAI) lets any pod alrea
Kubernetes Service Account token disclosure in the odh-dashboard component of Red Hat OpenShift AI (RHOAI) lets an authe
Server-side request forgery in the file_type content detector of guardrails-detectors (a component shipped with Red Hat
Arbitrary file write in the Feast Feature Server's `/save-document` endpoint lets an unauthenticated remote attacker wri
Privilege escalation in Red Hat OpenShift AI (RHOAI) training operator overlay allows any namespace editor to manage Tra
Privilege escalation in Red Hat OpenShift AI's training-operator enables any user holding a standard Kubernetes edit or
MySQL DSN parameter injection in Red Hat OpenShift AI's Data Science Pipelines Operator (DSPO) allows a namespace editor
Privilege escalation in odh-dashboard, the web interface for Red Hat OpenShift AI (RHOAI), allows any authenticated dash
Privilege escalation in odh-dashboard (Red Hat OpenShift AI) allows an attacker who has obtained the dashboard's Service
The MaaS (Model-as-a-Service) Gateway component in Red Hat OpenShift AI (RHOAI) is improperly configured, enabling any l
Same technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today