What happened
CVE-2026-117574 (CVSS 9.1, CWE-639): ai-gateway-payload-processing in Red Hat OpenShift AI (RHOAI) does not verify authorization before retrieving credentials from the shared store. An authenticated remote attacker submits a request naming another tenant's model identifier in the body or header, causing the service to inject the target tenant's API keys into the request and make unauthorized LLM calls, consuming the victim tenant's quota.
Why it matters
In a multi-tenant AI gateway, this breaks tenant isolation on the credential plane: an attacker can burn another tenant's LLM budget and issue requests signed with their keys, creating both cost-abuse and potential data/account leakage across tenants.
Attack vector
Authenticated user submits a request specifying another tenant's model identifier; the gateway returns the target tenant's stored API keys, enabling unauthorized LLM API usage against that tenant's quota.
Affected systems
Red Hat OpenShift AI — rhoai/odh-ai-gateway-payload-processing-rhel9.
Mitigation
Apply the Red Hat fix/advisory for ai-gateway-payload-processing; enforce authorization on the model-identifier before fetching credentials from the shared store.