vLLM orchestrator gateway: bearer tokens and full chat payloads written to persistent logs

Impact

The production binary of the vllm-orchestrator-gateway logged every incoming Authorization header and the full chat payload to persistent logs. Anyone who can read those logs - and on a Kubernetes fleet that is a much wider group than the inference team, covering cluster log aggregation, SRE dashboards and anyone with pod log access in the namespace - can harvest valid bearer tokens and replay them against the inference endpoint, and can read the prompt and response content of every tenant that went through the gateway. For a GPU operator running shared inference, that is simultaneously a credential leak and a disclosure of customer prompt data, and the logs may already be sitting in a long-retention store.

Who can reach it

Any party with read access to the gateway's logs or to the log aggregation pipeline, which on OpenShift includes namespace pod-log readers and the cluster logging stack. The leak needs no attack against the gateway itself - callers of the API populate the logs in normal operation.

What to do

Apply the Red Hat errata for your channel - RHSA-2026:84734 or RHSA-2026:87410 for Red Hat OpenShift AI 2.25 and 3.4 - which updates the component and restarts the gateway pods; no node drain. Patching stops new leakage but does not undo it: treat every bearer token that transited the gateway as exposed and rotate it, and purge or restrict the retained logs and any backups or SIEM copies of them.

References

Related entries

• SGLang (`/server_info`): Endpoint returns API keys and SSL keyfile pathsCVE-2026-15977 · SGLang (`/server_info`)High
• SGLang (weight exfiltration): Two endpoints allow a remote attacker to pull model weights when no API key is setCVE-2026-15978 · SGLang (weight exfiltration)High
• NVIDIA Triton Inference Server: unauthenticated request triggers excessive iteration and hangs the serverCVE-2026-16497 · NVIDIA Triton Inference Server for LinuxHigh
• Keras (HDF5 external links): Arbitrary local file read during model loadCVE-2026-1669 · Keras (HDF5 external links)High
• OpenShift AI Data Science Pipelines Operator: predictable PRNG generates MariaDB and MinIO credentialsCVE-2026-18611 · Red Hat OpenShift AI Data Science Pipelines Operator (generated MariaDB and MinIO credentials)High
• MLflow: unauthenticated arbitrary file read via prompt-tagged model version source pathCVE-2026-2614 · MLflow tracking server (`_create_model_version` / model version artifact handler)High