A bug in Red Hat’s AI gateway lets tenants hijack each other’s large language model keys, according to an advisory published on October 28. The flaw, tracked as CVE-2026-117574, affects the ai-gateway-payload-processing component used in multi-tenant AI inference stacks and carries a CVSS severity score of 9.1 out of 10.
An authenticated attacker can submit a request specifying another tenant’s model identifier, and because the service does not verify authorization before pulling credentials from the shared store, it injects the target tenant’s API keys into the outbound request. That lets the attacker consume another tenant’s LLM resources on the victim’s keys. Exploitation requires only low-privilege network access, and while no public proof of concept has appeared yet, the flaw is not on CISA’s known-exploited list.
To understand the severity, picture how a multi-tenant gateway works. Many customers share one service that routes their requests to AI models. Each customer has its own API keys, which act like a payment card for compute: whoever holds the key can spend the owner’s budget. The gateway’s job is to check, on every request, that the caller is who they claim to be and is allowed to use the key they present. In this flaw, that check was missing at the exact moment the service fetched credentials from a shared store — so a request naming someone else’s model could come back carrying someone else’s keys.
Why it matters
Multi-tenant AI gateways sit between many customers and their models, so a single authorization check failure can expose every tenant behind the gateway. The bug is a reminder that AI infrastructure inherits all the classic cloud security problems — tenant isolation, credential handling, authorization checks — and adds new ones, since API keys now gate access to expensive compute. Any organization running shared AI inference should patch promptly and audit whether tenant identifiers are ever trusted without verification.
The broader lesson applies well beyond one product. As companies build shared AI platforms, the boring parts of security — authorization checks, tenant isolation, credential storage — matter more, not less, because the asset being protected is now metered compute that can be spent in seconds. A CVSS score of 9.1 reflects that combination: low-privilege access, no user interaction, and a direct path to someone else’s resources. Patching is the immediate step; auditing every place where a tenant identifier is trusted without verification is the lasting one.
Source: The Hacker Wire, reported October 29, 2026.