In pkg/plugins/model-provider-resolver/plugin.go:101-138 (commit 547d2f6d3b2789446654b7a03fc43a19c56ade2a), ProcessRequest extracts segments[0] (namespace) and segments[1] (model name) directly from the client-supplied :path pseudo-header and uses them as a lookup key into the cluster-wide infoStore. The resulting secretName/secretNamespace are written to CycleState for apikey-injection without any in-process check that the authenticated caller is authorized for segments[0]. The design relies on Kuadrant AuthPolicy at the gateway to reject unauthorized paths before ext_proc runs. If the AuthPolicy does not cover every path, or if ext_proc port 9004 is directly reachable, a caller authenticated for tenant A can have tenant B's provider API key injected and consume tenant B's LLM quota and billing. This is amplified by cluster-wide secrets access (FIND-001, RHOAIENG-69785) and no NetworkPolicy on port 9004 (FIND-004, RHOAIENG-71961). Developer confirmed on 2026-06-29 that the vulnerable path parameter and this code are being removed as an architectural fix. CWE: CWE-639 (Authorization Bypass Through User-Controlled Key), CWE-441 (Confused Deputy). CVSS v3.1: 7.7 (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L). Source: Project Glasswing (Mythos) security audit. Reference: RHOAIENG-69786.