Zero Radar
← feed
CriticalVulnerabilityCVE-2026-117574updated 28 Oct 2026, 23:43 UTC

AI gateway lets one tenant use another tenant's LLM API keys

A logged-in user of a shared AI gateway can make it use another customer's private API keys. The attacker can then run AI requests on that customer's account, using their paid quota and billing.

Official, 2 sources
SeverityCriticalCVSS 9.1 of 10
Being exploited?UnclearNo reports either way yet
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Authenticated attackerHolds a valid account on the gateway
  2. 2Crafted requestNames another tenant's model identifier
  3. 3Gateway processes requestSkips authorization check
  4. 4Shared credential storeVictim's API keys retrieved
  5. 5LLM provider callSent with victim's keys
  6. ResultVictim's LLM quota consumed by attacker

What happened

In ai-gateway-payload-processing, the service does not check authorization before fetching credentials from a shared store when a request names another tenant's model identifier, and it injects that tenant's API keys into the outgoing request.

Why it is dangerous: Tenants of the shared gateway can have their LLM API keys used without permission, causing unauthorized requests, consumed quotas, and charges. Any organization whose keys sit in the same shared store is at risk.

Are you affected?

You are affected if you run ai-gateway-payload-processing in a multi-tenant setup where several tenants share one credential store.

ai-gateway-payload-processing (versions not specified in the provided material)

What to do

  1. Check whether your ai-gateway-payload-processing deployment serves multiple tenants with a shared credential store
  2. Watch the official GitHub advisory GHSA-4c29-j43w-vg8g for a patched version and update when released
  3. Review LLM provider usage and quota logs for requests you did not make
  4. Restrict who can submit requests to the gateway and rotate tenant API keys if misuse is suspected

Timeline

  1. 28 Oct 2026, 20:17 UTC
    Publicly disclosed
  2. 28 Oct 2026, 20:17 UTC
    Reported by NVD · NVD
  3. 28 Oct 2026, 20:17 UTC
    Picked up by Zero Radar
  4. 28 Oct 2026, 23:43 UTC
    GitHub Advisory reported on it · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-117574 · GHSA-4c29-j43w-vg8g
CVSS
9.1 / 10
EPSS
0.2% chance of exploitation within 30 days
Disclosed
28 Oct 2026, 20:17 UTC
On Zero Radar
28 Oct 2026, 20:17 UTC (1 min after disclosure)
Last change
28 Oct 2026, 23:43 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

AI gateway lets one tenant use another tenant's LLM API keys · Zero Radar