vllm-orchestrator-gateway CVE-2026-15574

Exploitation requires read access to the persistent logs produced by the vllm-orchestrator-gateway production binary - i.e., 'logging privileges' such as OpenShift log-viewer RBAC, access to the container's stdout/log volume, or access to the downstream aggregation backend (Loki/EFK). The sensitive data only appears in logs if the gateway processes traffic carrying Authorization headers and chat payloads, so the value depends on real request volume. Limiting factors: the CVSS AV:N/PR:N rating overstates reach - actual disclosure is gated behind authorized log access rather than anonymous network access; impact is confidentiality-only (no integrity or availability effect); and the exposure window depends on log retention and whether centralized aggregation broadens who can read the logs.

The published CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N = 7.5, High) models this as a remote, unauthenticated confidentiality breach, but that framing conflicts with the description, which states the data is exposed only to a 'user with logging privileges' - an authenticated, authorized insider or a compromised log-reader account, not an anonymous network attacker. This is a meaningful discrepancy: the real attack surface is access to the log store, so the practical privilege requirement is closer to PR:L and the vector closer to local/log access than AV:N/PR:N - verify with Red Hat. No EPSS score, KEV entry, or POC was provided; the impact is limited strictly to confidentiality (I:N/A:N). Real-world priority is moderate and context-dependent: high-value where logs are broadly readable or externally aggregated and where the leaked bearer tokens are long-lived, but lower where log RBAC is tightly scoped. Treat it as a secrets-hygiene/credential-exposure problem rather than a wormable remote exploit.

An SRE, platform operator, or a service account scoped to the logging stack opens the aggregated gateway logs and reads plaintext Authorization: Bearer tokens alongside full chat prompts and responses. They replay a harvested token against the LLM API to impersonate legitimate callers and exfiltrate the captured PII-bearing conversation content. No public POC is required, and no user interaction or crafted payload is needed - normal traffic populates the logs automatically.