External risk intelligence

Authenticated LLM Resource Access Vulnerability in ai-gateway-payload-processing.

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-117574

The vulnerability resides in an AI gateway, which is typically deployed as an internet-facing API or service to manage and proxy requests to large language models. As a service designed to process external or multi-tenant API requests, it is commonly exposed at the network edge to facilitate connectivity for authorized users, making public-facing or external-facing deployment a standard pattern.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability impacts AI gateway services that process requests for large language models. An attacker with authenticated access could potentially misuse another tenant's API keys to perform unauthorized actions and consume shared AI resources. The main concern is confirming if your environment utilizes this type of technology and is exposed to this threat.

Accessing other tenants' AI resources is possible.
Limits unauthorized resource usage and potential cost overruns.
Verify if your AI gateway is affected by this threat.

Attack Path

How an attacker could exploit the issue

An attacker with authenticated access can target a vulnerable AI gateway by sending a crafted request that includes another tenant's model identifier. The gateway, failing to properly check authorization, will mistakenly use the attacker's provided model identifier to retrieve and inject the target tenant's API keys. This allows the attacker to then issue unauthorized requests, effectively hijacking another tenant's resources.

Authenticated remote access required.
Submitting another tenant's model identifier.
Unauthorized requests, resource consumption.

Live Threat

Current exploitation, exposure, and threat context

An authenticated attacker could exploit this vulnerability by submitting specially crafted requests to the ai-gateway-payload-processing service. This could lead to unauthorized access and use of another tenant's API keys, allowing the attacker to make requests on behalf of that tenant.

Tenant API keys could be exposed.
Attacker sends malicious requests to gateway.
Unauthorized API calls and resource consumption.

Operational Fix

Recommended remediation, mitigation, and detection steps

Teams responsible for the ai-gateway-payload-processing service, potentially platform or infrastructure teams, must first identify all deployments of this technology. Confirming external reachability and business criticality is paramount to prioritizing remediation efforts. Once accountable owners are identified, a risk-based remediation plan can be developed, which may involve vendor coordination or temporary mitigations.

Identify service ownership and scope.
Verify external reachability and impact.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is ai-gateway-payload-processing?

It is a software component designed to act as an intermediary for large language models. Its primary function is to manage and route requests between users and AI services, often handling authentication, credential retrieval, and load balancing for multiple tenants in shared environments.

What does CVE-2026-117574 mean for my system?

This vulnerability is an instance of Authorization Bypass (CWE-639). It means the software fails to confirm if a user is allowed to access the data they are requesting. In this case, the gateway mistakenly retrieves and uses the wrong tenant's API keys when a specific model identifier is provided, allowing one user to act as another.

How can an attacker trigger this vulnerability?

An attacker needs existing authenticated access to the service to trigger this flaw. By including a different tenant's model identifier in their request, they cause the gateway to pull that tenant's credentials. Simply sending standard, non-malicious requests without manipulating the model identifier does not trigger this unauthorized credential retrieval.

Why should I care about this vulnerability?

Halo Surface Signal indicates that AI gateways are typically deployed as internet-facing services to facilitate external connectivity. If your gateway is reachable from outside your network, an attacker with authenticated access can exploit this flaw to hijack other tenants' resources, potentially leading to unauthorized costs and service disruption.

Do I need to take action to address CVE-2026-117574?

Yes, you should begin by inventorying all deployments of the affected service to understand where it is running and who is responsible for it. Once you have identified these instances, determine if they are exposed to external traffic and coordinate with your infrastructure or platform teams to plan for necessary patches or security updates.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.