Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
A flaw was found in the vllm-orchestrator-gateway component. The system's production binary logs all incoming authorization headers and full chat payloads, which may contain personally identifiable information (PII) and secrets, to persistent logs. This sensitive data, including bearer tokens and chat content, can be accessed by any user with logging privileges. This vulnerability leads to information disclosure, potentially allowing an attacker to harvest credentials and sensitive conversation content.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
Critical flaw CVE-2026-15574 in vllm-orchestrator-gateway exposes bearer tokens and chat content, with CVSS 7․5; watch for patches and exploitation. https://ift.tt/APL2hmC
Post summary
CVE‑2026‑15574 is a critical flaw in vllm‑orchestrator‑gateway that exposes bearer tokens and chat content, ratedümay 7.5; vendors should release patches soon.