Katanemo Plano: unauthenticated Envoy admin interface leaks LLM provider API keys

Impact

Plano is an LLM gateway that fronts model providers for applications running on the fleet. It ships an embedded Envoy whose admin interface is bound to all host interfaces on port 9901 with no authentication, so anyone who can reach that port can request /config_dump and read the configured LLM provider API keys in plaintext out of the WASM filter configuration. On a GPU cluster that means harvesting the credentials every tenant workload routes through - usable from outside the cluster for billed inference, and useful for pivoting into whatever else those keys authorize. The admin interface also exposes Envoy's own control surface, which is a configuration-tampering path beyond the key disclosure.

Who can reach it

Anyone with network reach to the Plano host on TCP 9901 - no authentication required. In a default deployment that is any pod in the cluster, and anything upstream of the node if 9901 is not blocked at the network edge.

What to do

No fixed version is named in the record; all releases through 0.4.37 are affected. Block or firewall TCP 9901 so it is reachable only from localhost, or override the Envoy bootstrap so the admin listener binds 127.0.0.1, and rotate every LLM provider API key that was present in the configuration. Applying either mitigation means restarting the Plano gateway process - a brief interruption to inference routing, no node drain.

References

Related entries

• SGLang: oversized audio uploads are buffered in memory, crashing the HTTP/tokenizer workerCVE-2026-109225 · SGLang HTTP server (/v1/audio/transcriptions multipart upload)High
• SGLang: compressed audio decodes without duration limits, exhausting worker memory and CPUCVE-2026-109226 · SGLang load_audio (audio_url / audio_data decoding, no duration or sample limit)High
• SGLang: full-resolution video decode before max_pixels clamp exhausts inference worker memoryCVE-2026-109227 · SGLang (Qwen-VL video preprocessing, preprocess_video in qwen_vl.py)High
• SGLang: client can override GLM-V video decode budget via video_url fields and exhaust worker memoryCVE-2026-109228 · SGLang (GLM-V video processing, client-supplied fps/max_frames limits in glm4v.py)High
• SGLang: NanoNemotronVL processor disables Pillow decompression-bomb limit process-wideCVE-2026-109229 · SGLang (NanoNemotronVLImageProcessor sets Pillow Image.MAX_IMAGE_PIXELS to None)High
• vLLM (MOSS-Audio multimodal processor cache, /tokenize endpoint): vLLM caches a processor object for every distinctCVE-2026-114052 · vLLM (MOSS-Audio multimodal processor cache, /tokenize endpoint)High