CVE-2026-117574

{
  "etk_id": "ETK-2026-2901",
  "cve_id": "CVE-2026-117574",
  "display_id": "CVE-2026-117574",
  "ghsa_id": "GHSA-4c29-j43w-vg8g",
  "euvd_id": "EUVD-2026-112460",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Cross-tenant authorization bypass in ai-gateway-payload-processing",
  "summary": "ai-gateway-payload-processing in Red Hat OpenShift AI is affected by a cross-tenant authorization flaw. An authenticated remote attacker may cause requests to use another tenant's API credentials, allowing unauthorized consumption of that tenant's LLM resources and quotas. Exploitation requires an authenticated attacker able to submit requests that select a target tenant's model identifier.",
  "mitigation": "Restrict access to the affected gateway to trusted, tenant-scoped identities and monitor for requests selecting models outside the caller's tenant. Apply the vendor's corrected release when it becomes available; no fixed version is recorded in the provided package data.",
  "vendor": "Red Hat",
  "product": "Red Hat OpenShift AI (RHOAI)",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "rhoai/odh-ai-gateway-payload-processing-e2e-rhel9",
      "purl": null
    },
    {
      "affected_notes": [],
      "affected_ranges": [],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "rhoai/odh-ai-gateway-payload-processing-rhel9",
      "purl": null
    }
  ],
  "cwes": [
    639
  ],
  "cvss_score": 9.1,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 62.56105436666667,
  "t0_at": "2026-10-28T20:02:14.895000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-28T20:02:14.895000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-28T20:02:14.895000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-117574"
    }
  }
}