{"data":{"id":"c657464e-18fe-44a6-a9b7-05cae8a83284","title":"CVE-2026-15574: A flaw was found in the vllm-orchestrator-gateway component. The system's production binary logs all incoming…","summary":"CVE-2026-15574 affects the vllm-orchestrator-gateway component. Its production binary writes all incoming authorization headers and full chat payloads to persistent logs, including bearer tokens, personally identifiable information and secrets. Any user with logging privileges can read this data, which may let an attacker harvest credentials and conversation content.","solution":"N/A -- no mitigation discussed in source.","labels":["security","privacy"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-15574","publishedAt":"2026-07-13T09:16:24.550Z","cveId":"CVE-2026-15574","cweIds":["CWE-538"],"cvssScore":"7.5","cvssSeverity":"high","severity":"high","attackType":["pii_leakage","data_extraction"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["vllm-orchestrator-gateway","vLLM"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"vllm-orchestrator-gateway logs authorization headers and chat payloads","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","attackVector":"network","attackComplexity":"low","privilegesRequired":"none","userInteraction":"none","exploitMaturity":"unknown","epssScore":0.00439,"epssCheckedAt":"2026-10-14T12:12:44.054Z","kevDateAdded":null,"advisoryAliases":["GHSA-fgpg-f5rm-p28p"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-10-10T03:46:49.048Z","patchAvailable":null,"disclosureDate":"2026-07-13T09:16:24.550Z","capecIds":["CAPEC-127"],"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality"],"aiComponentTargeted":"api","llmSpecific":true,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null}}