CVE-2026-117574Critical· 9.1▾ MidnightA flaw was found in ai-gateway-payload-processing. An authenticated remote attacker can exploit this vulnerability by submitting a request specifying another tenant's model identifier in the request body or header. Because the service do…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 50.1 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 29.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.2%
A flaw was found in ai-gateway-payload-processing. An authenticated remote attacker can exploit this vulnerability by submitting a request specifying another tenant's model identifier in the request body or header. Because the service does not verify authorization before retrieving credentials from the shared store, it injects the target tenant's application programming interface (API) keys into the request. This flaw allows an attacker to perform unauthorized requests and consume another tenant's large language model (LLM) resources and quotas.
rhoai/odh-ai-gateway-payload-processing-e2e-rhel9rhoai/odh-ai-gateway-payload-processing-rhel9 (all versions)Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2024-1313Medium· 6.5grafana: vulnerable to authorization bypass (CVE-2024-1313)
CVE-2026-15564High· 7.4Wildfly-ejb: wildfly-iiop-openjdk: eap iiop listeners may permit unauthed deserialization
CVE-2026-117859Medium· 5.4Keycloak-services: keycloak-services: par single-use bypass via flow restart
CVE-2026-19610Medium· 6.5Wildfly-platform-mbean: wildfly-platform-mbean: rbac sensitive attribute read bypass for platform runtimemxbean
CVE-2026-118030Medium· 4.2Keycloak-services: keycloak-services: hotp race condition allows single otp code reuse across concurrent logins
CVE-2026-118425Medium· 6.8Keycloak-services: keycloak-services: redirect uri domain allowlist bypass via dns resolution to loopback