Potheeswaran 
A newly disclosed vulnerability in Red Hat OpenShift AI’s vllm-orchestrator-gateway component is raising fresh concerns about credential hygiene in AI inference pipelines.
Tracked as CVE-2026-15574, the flaw causes the gateway to log full authorization headers and complete chat payloads at DEBUG level by default, exposing bearer tokens and potentially sensitive conversation content to anyone with logging access in the cluster.
Red Hat has assigned the issue a Moderate severity rating with a CVSS v3.1 base score of 7.5, reflecting a network-exploitable, low-complexity attack path requiring no privileges or user interaction.
OpenShift AI Gateway Flaw
The vllm-orchestrator-gateway, part of Red Hat OpenShift AI’s TrustyAI stack, sits between users and large-language-model inference endpoints. According to Bugzilla entry 2499594, the production binary hard-codes DEBUG-level logging that captures incoming authorization headers and entire chat payloads.
In OpenShift deployments, these logs don’t stay isolated. They flow into the node journal and the cluster logging stack, where any user holding pods/log RBAC permissions within the relevant namespace allow them to read them.
That’s a notably low bar for exposure, since log-viewing access is common among developers, SREs, and support staff who have no business seeing raw bearer tokens or private prompt content.
This isn’t a typical web app credential leak. Chat payloads sent to LLM gateways often contain proprietary business logic, customer PII, internal documents, or fragments of authentication data pasted for troubleshooting.
Combine that with a persistently logged bearer token, and an attacker with log access gains a two-for-one: session hijacking material plus a window into sensitive organizational conversations.
The CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N confirms this is purely a confidentiality issue. There’s no impact on integrity or availability, but the “High” confidentiality score underscores how much data could realistically be harvested from a single misconfigured log stream.
Red Hat lists the following as impacted:
- Product: Red Hat OpenShift AI (RHOAI)
- Component: rhoai/odh-trustyai-vllm-orchestrator-gateway-rhel9
- Status: Under investigation
- Errata: None issued yet
Red Hat notes that all previous minor-stream versions should be presumed vulnerable, absent explicit confirmation to the contrary, though full analysis is still pending.
Mitigation
Since no patch has shipped, Red Hat’s guidance centers on a configuration change rather than a code fix:
- Set the
RUST_LOGenvironment variable for vllm-orchestrator-gateway toinfoor higher, rather than the default DEBUG. - Apply this via deployment configuration (e.g.,
RUST_LOG=info). - Restart affected pods or services for the change to take effect.
This effectively suppresses the verbose logging path that captures headers and payloads, without requiring a binary update.
CVE-2026-15574 fits a recurring theme in AI infrastructure security: logging and observability tooling built for debugging convenience often outpaces production hardening.
As organizations rush to deploy LLM gateways and orchestration layers, verbose logging defaults meant to ease development frequently make it into production untouched, turning a helpful debugging feature into a standing credential leak.
Security teams running OpenShift AI should audit their RUST_LOG settings immediately and review existing log retention for any historical exposure, even before an official patch lands.
About the Author
