CVE-2026-15574: vllm-orchestrator Information Disclosure

CVE-2026-15574 Overview

CVE-2026-15574 is an information disclosure vulnerability in the vllm-orchestrator-gateway component. The production binary writes all incoming Authorization headers and full chat payloads to persistent logs. These logs retain bearer tokens, personally identifiable information (PII), and chat content in plaintext. Any user with logging privileges can read this sensitive material, expanding the credential and data exposure blast radius well beyond the gateway itself.

The issue is tracked under [CWE-538: Insertion of Sensitive Information into Externally-Accessible File or Directory]. Red Hat has published an advisory for this flaw.

Critical Impact
Attackers with log access can harvest bearer tokens, replay authenticated API calls, and exfiltrate private chat payloads containing PII and secrets.

Affected Products

vllm-orchestrator-gateway component (production binary)
Deployments integrating the vLLM orchestrator gateway for large language model (LLM) request routing
Environments where gateway logs are ingested into shared logging or observability pipelines

Discovery Timeline

2026-07-13 - CVE-2026-15574 published to the National Vulnerability Database (NVD)
2026-07-13 - Last updated in the NVD database

Technical Details for CVE-2026-15574

Vulnerability Analysis

The vllm-orchestrator-gateway terminates client requests destined for backend LLM workers. During request handling, the production build emits verbose log records that contain the full HTTP request context. Those records include the Authorization header value and the complete chat payload body.

Bearer tokens embedded in the Authorization header grant the same privileges as the calling user or service account. Chat payloads frequently carry personal data, source code, business secrets, and prompt content the sender considers private. Writing both to persistent storage collapses the trust boundary between the request channel and the logging subsystem.

An attacker does not need to intercept traffic in transit. Any principal that can read the gateway log stream, including SREs, platform operators, or a compromised log aggregator, can extract usable credentials and data at rest. Reference the Red Hat CVE-2026-15574 Advisory and Red Hat Bug Report #2499594 for vendor detail.

Root Cause

The root cause is an unsafe logging policy in the gateway binary. Request middleware serializes the entire HTTP request, including headers and body, without redacting fields flagged as sensitive. There is no allow-list or hashing applied to Authorization, Cookie, or payload fields before the record is committed to persistent storage.

Attack Vector

Exploitation is passive and does not require authenticated network access to the gateway itself. An attacker who obtains read access to gateway logs, whether through misconfigured log storage, an over-permissive logging role, or a downstream SIEM export, retrieves bearer tokens and chat content directly. Recovered tokens can then be replayed against the gateway or downstream services over the network to impersonate legitimate users.

No verified public exploit code is available. The vulnerability manifests entirely in log content, so no proof-of-concept binary is required to reproduce the exposure.

Detection Methods for CVE-2026-15574

Indicators of Compromise

Log records from vllm-orchestrator-gateway containing raw Authorization: Bearer strings or full JSON chat payloads.
Unexpected read access to gateway log paths or log indices by accounts outside the platform operations team.
Bulk export or download activity against log storage buckets or SIEM indices holding gateway telemetry.
Replay of bearer tokens from source IP addresses or user agents that differ from the original issuing client.

Detection Strategies

Grep or query historical log stores for regular expressions matching Authorization:\s*Bearer\s+[A-Za-z0-9._-]+ to quantify exposure.
Correlate token identifiers (jti or hashed prefix) seen in logs with subsequent authenticated API calls to detect reuse from new sources.
Alert on log queries or exports that touch fields known to contain gateway payload bodies.
Track service accounts with logs:read permissions and flag any grant that exceeds the platform operations baseline.

Monitoring Recommendations

Ingest vllm-orchestrator-gateway logs into a monitored pipeline and apply pattern-matching rules for secret formats such as bearer tokens, JSON Web Tokens (JWTs), and API keys.
Enable audit logging on the log storage backend itself and forward those audit records to an independent tenant.
Rotate bearer tokens on a fixed cadence so historic log exposure has a bounded validity window.
Review log retention policies and shorten retention for gateway components until a fixed build is deployed.

How to Mitigate CVE-2026-15574

Immediate Actions Required

Rotate all bearer tokens, API keys, and service account credentials that have transited the vllm-orchestrator-gateway since deployment.
Restrict read access to gateway logs to a minimal set of named administrators and revoke broad logs:read grants.
Purge or quarantine existing log archives that contain unredacted Authorization headers and chat payloads.
Notify data owners whose chat payloads may include PII, per applicable breach notification obligations.

Patch Information

Apply the vendor-supplied fixed build of vllm-orchestrator-gateway when available. Track the Red Hat CVE-2026-15574 Advisory for fixed package versions and errata identifiers. Confirm that the patched build redacts Authorization headers and payload bodies before verifying closure of the finding.

Workarounds

Configure an upstream reverse proxy or sidecar to strip the Authorization header value before the request reaches the gateway logger, replacing it with a hashed identifier.
Set the gateway log level to a value that suppresses request header and body serialization until the patched build is deployed.
Route gateway logs to an isolated, encrypted store with break-glass access controls and no downstream replication.
Deploy log-scrubbing filters in the aggregation layer that redact tokens and known payload fields on ingest.

bash

# Example log-scrubbing filter (Fluent Bit) applied on ingest
[FILTER]
    Name    modify
    Match   vllm.gateway.*
    Remove  authorization
    Remove  cookie

[FILTER]
    Name    lua
    Match   vllm.gateway.*
    script  redact.lua
    call    redact_bearer