CVE-2026-117574
Vulnerability data via NVD (ingested)
A flaw was found in ai-gateway-payload-processing. An authenticated remote attacker can exploit this vulnerability by submitting a request specifying another tenant's model identifier in the request body or header. Because the service does not verify authorization before retrieving credentials from the shared store, it injects the target tenant's application programming interface (API) keys into the request. This flaw allows an attacker to perform unauthorized requests and consume another tenant's large language model (LLM) resources and quotas.
External references
Search for exposed instances
Shodan + Censys queries derived from NVD's CPE data. The vuln tag catches assets Shodan has explicitly linked to this CVE; the product / banner fingerprints find exposed instances even when the vuln tag was never applied (which is common).
vuln:CVE-2026-117574More intel sources (5)
vuln:CVE-2026-117574vulnerabilities.cve_id: CVE-2026-117574CVE-2026-117574CVE-2026-117574"CVE-2026-117574" exploit -site:nvd.nist.gov