HighVulnerabilityLLM-specific
CVE-2026-15574: vllm-orchestrator-gateway logs authorization headers and chat payloads
- Source
- NVD(opens in a new tab)
- Identifier
- CVE-2026-15574
- Published
- Record updated
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 0.4%
Summary
CVE-2026-15574 affects the vllm-orchestrator-gateway component. Its production binary writes all incoming authorization headers and full chat payloads to persistent logs, including bearer tokens, personally identifiable information and secrets. Any user with logging privileges can read this data, which may let an attacker harvest credentials and conversation content.
Mitigation
The source does not state a fix yet. Check the original advisory for updates.
Topics
Related items
- MediumAI coding agents expose developer screenshots on GitHub reposSimilar attack · ReversingLabs Blog
- InfoCost-Efficient Privacy Enforcement for Email-Generating LLM Agents under Strategic Information RequestsSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
- InfoLLM Development Risks: Security Threats and Mitigation Strategies | Endor LabsSimilar attack · Endor Labs Blog
- InfoHow to Secure AI Models in Production Environments | Endor LabsSimilar attack · Endor Labs Blog
- InfoWhen Agents Talk, Secrets Travel: Topology-Driven Leakage and Recipient-Conditioned Sanitization in Multi-Agent LLM SystemsSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)