Bug 2494861 (CVE-2026-117574)

Summary:	CVE-2026-117574 ai-gateway-payload-processing: ai-gateway-payload-processing: Tenant/credential selection from client-controlled URL path with no in-process authorization
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	jkoehler, lphiri, security-response-team
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in ai-gateway-payload-processing. An authenticated remote attacker can exploit this vulnerability by submitting a request specifying another tenant's model identifier in the request body or header. Because the service does not verify authorization before retrieving credentials from the shared store, it injects the target tenant's application programming interface (API) keys into the request. This flaw allows an attacker to perform unauthorized requests and consume another tenant's large language model (LLM) resources and quotas.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-06-30 12:16:08 UTC

In pkg/plugins/model-provider-resolver/plugin.go:101-138 (commit 547d2f6d3b2789446654b7a03fc43a19c56ade2a), ProcessRequest extracts segments[0] (namespace) and segments[1] (model name) directly from the client-supplied :path pseudo-header and uses them as a lookup key into the cluster-wide infoStore. The resulting secretName/secretNamespace are written to CycleState for apikey-injection without any in-process check that the authenticated caller is authorized for segments[0]. The design relies on Kuadrant AuthPolicy at the gateway to reject unauthorized paths before ext_proc runs. If the AuthPolicy does not cover every path, or if ext_proc port 9004 is directly reachable, a caller authenticated for tenant A can have tenant B's provider API key injected and consume tenant B's LLM quota and billing. This is amplified by cluster-wide secrets access (FIND-001, RHOAIENG-69785) and no NetworkPolicy on port 9004 (FIND-004, RHOAIENG-71961). Developer confirmed on 2026-06-29 that the vulnerable path parameter and this code are being removed as an architectural fix. CWE: CWE-639 (Authorization Bypass Through User-Controlled Key), CWE-441 (Confused Deputy). CVSS v3.1: 7.7 (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L). Source: Project Glasswing (Mythos) security audit. Reference: RHOAIENG-69786.