CVE-2026-117574: Critical Tenant Isolation Bypass in LLM AI Gateway — Detection, Key Rotation, and Remediation Guide

NVD has published CVE-2026-117574, a CVSS 9.1 (CRITICAL), network-exploitable vulnerability in llm, a widely deployed AI gateway component that brokers requests between tenants and large language model (LLM) backends. The flaw lives in the gateway's request-processing path: an authenticated remote attacker can submit a request that specifies another tenant's model identifier in the request body or header. Because the service fails to verify authorization before pulling credentials from the shared credential store, it injects the target tenant's API keys into the request — handing the attacker the ability to issue unauthorized LLM calls and burn through a victim tenant's resources and quotas.

This is a textbook Broken Object Level Authorization (BOLA/IDOR) failure transplanted into AI infrastructure — the same class of flaw that has topped the OWASP API Security Top 10 for years, now with a blast radius that includes cloud LLM spend, data exposure through model context, and cross-tenant trust boundaries. If you operate a multi-tenant llm gateway — internally for business units or as a service for customers — treat this as an emergency change. An authenticated low-privilege user (API key, service account, or even a compromised trial account) is all that stands between an attacker and another tenant's LLM budget and API credentials.

Financial impact is the obvious risk — LLM quota exhaustion and runaway token consumption can generate five- and six-figure bills in hours. The quieter risk is confidentiality: requests routed under another tenant's identity may expose that tenant's prompts, model configuration, fine-tuned endpoints, and downstream data integrations.

Technical Analysis

Affected Component

How the Vulnerability Works

The exploitation chain is elegant in its simplicity — and damning in its design failure:

1. Attacker authenticates to the llm gateway with their own valid, low-privilege tenant credentials (their own API key or session token).
2. Attacker crafts a request to the model-inference or completion endpoint, but sets the model identifier — passed in the request body (e.g., a model field) or an HTTP header — to a model identifier belonging to a different tenant.
3. The gateway resolves the model identifier against the shared credential store and retrieves the API keys associated with that model/tenant without first checking whether the authenticated principal is authorized to use that model identifier.
4. The victim tenant's API keys are injected into the upstream request to the LLM provider. The call succeeds, billed against the victim's quota, executed under the victim's identity.
5. The attacker can now enumerate model identifiers (naming conventions are often predictable — org names, UUIDs discoverable via error messages, or identifiers leaked in documentation and client SDKs) and systematically abuse every tenant on the platform.

The core defect is ordering: credential retrieval happens before authorization, or authorization is simply absent on the model-identifier-to-credential binding. In secure multi-tenant design, the authorization check (does authenticated tenant T1 own model identifier M?) must gate every credential lookup.

Why the CVSS 9.1 Is Justified

A 9.1 network score with low attack complexity, low privileges required, and no user interaction reflects exactly what we see here: scope change (the attacker escapes their own tenant security authority), high confidentiality impact (cross-tenant key material and request data), and integrity impact on another tenant's resources. The one mitigating factor is the PR:L — an account is required — but in any gateway that issues self-service or trial keys, that bar is negligible.

Exploitation Status

At time of writing, NVD lists the vulnerability as published with no confirmed in-the-wild exploitation and no CISA KEV entry yet. Do not let that lower your urgency: the exploit primitive requires nothing more than an HTTP client and a valid API key, and cross-tenant model identifiers are trivially enumerable. Any public PoC drop will make this a mass-exploitation candidate within days, particularly against SaaS-hosted llm gateways. If your gateway is internet-facing, assume reconnaissance against model identifier naming schemes is already happening.

Detection & Response

The single most reliable detection signal for CVE-2026-117574 exploitation is a tenant identity mismatch: the authenticated principal (API key, client ID, source identity) does not match the tenant that owns the requested model identifier. Every gateway and WAF log that captures both fields gives you this join. Secondary signals include enumeration patterns (one identity cycling through many distinct model identifiers) and sudden quota spikes on tenants correlated with request volumes originating from other identities.

Sigma Rules

---
title: LLM Gateway Cross-Tenant Model Identifier Request
description: Detects requests to an LLM gateway where the requested model identifier belongs to a different tenant than the authenticated principal — the core exploitation primitive of CVE-2026-117574. Requires gateway/application logs that record both the authenticated tenant identity and the requested model identifier and its owning tenant.
status: experimental
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-117574
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.privilege_escalation
  - attack.t1078
logsource:
  category: application
  product: llm-gateway
detection:
  selection:
    event.action:
      - 'model_request'
      - 'completion_request'
      - 'inference_request'
    tenant_mismatch: true
  condition: selection
falsepositives:
  - Legitimate shared/enterprise models intentionally exposed to multiple tenants — maintain an allowlist of public model identifiers and exclude them
  - Migration windows where tenants are being re-keyed
level: high
---
title: LLM Gateway Model Identifier Enumeration by Single Identity
description: Detects a single authenticated principal requesting an abnormally high number of distinct model identifiers within a short window — consistent with tenant/model enumeration preceding or accompanying CVE-2026-117574 exploitation. Tune the threshold to your baseline; SaaS gateways with many tenants should expect enumeration well above normal per-key model diversity.
status: experimental
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-117574
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.discovery
  - attack.t1046
logsource:
  category: application
  product: llm-gateway
detection:
  selection:
    event.action:
      - 'model_request'
      - 'completion_request'
      - 'inference_request'
  condition: selection | count(distinct model_id) by authenticated_tenant, source_ip > 10
  timeframe: 5m
falsepositives:
  - Load-testing or benchmarking jobs that sweep across sanctioned models — scope those service accounts out
  - CI/CD validation pipelines — exclude known automation source IPs
level: medium

A note on fidelity: the first rule assumes your gateway logs emit a tenant_mismatch-style field or that your pipeline enriches model_id with its owning tenant so the comparison can be made at the SIEM layer. If your gateway does not log both the authenticated identity and the requested model identifier, close that visibility gap today — it is the difference between detecting this attack and reading about your incident in a billing anomaly report.

KQL — Microsoft Sentinel / Defender

This query assumes llm gateway application logs are ingested into Sentinel via CEF/Syslog (CommonSecurityLog/Syslog) or a custom log table (adjust table and column names to your ingestion schema — the analytic logic is what matters):

// CVE-2026-117574 hunt: cross-tenant model identifier abuse on llm gateway
// Adjust table/column names to match your gateway log ingestion schema
let lookback = 7d;
let enum_threshold = 10;
let LLMRequests = CommonSecurityLog
    | where TimeGenerated > ago(lookback)
    | where DeviceProduct has "llm" or ApplicationProtocol has "llm-gateway"
    // Parse authenticated tenant and requested model identifier from extension fields
    | extend AuthenticatedTenant = tostring(AdditionalExtensions.authenticated_tenant),
             ModelId = tostring(AdditionalExtensions.model_id),
             ModelOwnerTenant = tostring(AdditionalExtensions.model_owner_tenant),
             HttpStatus = tostring(AdditionalExtensions.response_code)
    | where isnotempty(AuthenticatedTenant) and isnotempty(ModelId);
// Signal 1: direct cross-tenant mismatch — authenticated tenant != model owner
LLMRequests
| where isnotempty(ModelOwnerTenant) and AuthenticatedTenant != ModelOwnerTenant
| summarize Requests = count(), DistinctModels = dcount(ModelId), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
    by AuthenticatedTenant, ModelOwnerTenant, SourceIP
| order by Requests desc;
// Signal 2: enumeration — one identity touching many distinct model IDs
LLMRequests
| summarize DistinctModelIds = dcount(ModelId), TotalRequests = count(), ModelsTouched = make_set(ModelId, 50)
    by AuthenticatedTenant, SourceIP, bin(TimeGenerated, 5m)
| where DistinctModelIds > enum_threshold
| order by DistinctModelIds desc;

If you only have upstream LLM provider billing/usage logs (e.g., from Azure OpenAI, Anthropic, or OpenAI usage exports), hunt for quota spikes on victim tenant keys whose request volume is not matched by your gateway's per-tenant request counts — divergence between gateway-accounted usage and provider-billed usage per key is a strong retro-hunt indicator of key injection abuse.

Velociraptor VQL

For self-hosted llm gateway servers, this artifact hunts the local gateway access/application logs for cross-tenant request patterns — useful for retro-hunting hosts where logs never reached the SIEM:

-- CVE-2026-117574: Hunt llm gateway logs for cross-tenant model requests and enumeration
-- Adjust the glob path to your gateway's log location
LET logs = SELECT FullPath, parse_string_to_regex(string=Line) AS RawLine, Line
FROM parse_lines(filename=FullPath)
WHERE Line =~ 'model'

LET parsed = SELECT FullPath, Line,
    re_replace(source=Line, re='.*tenant[=\" :]+([a-zA-Z0-9\\-_]+).*', replace='$1') AS AuthenticatedTenant,
    re_replace(source=Line, re='.*model[_-]?id[=\" :]+([a-zA-Z0-9\\-._]+).*', replace='$1') AS ModelId
FROM parse_lines(filename=path_join(components=[log_dir, "*.log"]))
WHERE Line =~ 'model[_-]?id'

SELECT AuthenticatedTenant,
       ModelId,
       count() AS RequestCount,
       count(item=ModelId, filter='distinct') AS DistinctModels
FROM parsed
GROUP BY AuthenticatedTenant
HAVING DistinctModels > 10
ORDER BY DistinctModels DESC

In practice, pairing this with netstat() on the gateway host to confirm which external identities were connected during the suspicious window (SELECT Pid, Name, RemoteAddr, RemotePort, Status FROM netstat() WHERE Name =~ 'llm|gateway') gives responders a fast triage path on compromised or suspect gateway nodes.

Remediation / Audit Script (Bash)

Use this on self-hosted llm gateway nodes to (1) audit recent logs for cross-tenant indicators, (2) verify whether your deployed version enforces authorization before credential retrieval, and (3) prepare for emergency key rotation:

#!/usr/bin/env bash
# CVE-2026-117574 triage — llm gateway cross-tenant abuse audit
set -euo pipefail

LOG_DIR="${LLM_GATEWAY_LOG_DIR:-/var/log/llm-gateway}"
LOOKBACK_HOURS=72
REPORT="cve-2026-117574-audit-$(date +%Y%m%d-%H%M%S).txt"

echo "=== CVE-2026-117574 llm gateway audit — $(date -u) ===" | tee "$REPORT"

# 1) Installed gateway version — compare against vendor fixed version
echo -e "\n[1] Installed llm gateway version:" | tee -a "$REPORT"
(command -v llm-gateway >/dev/null && llm-gateway --version) || \
  pip show llm 2>/dev/null | grep -E '^(Name|Version)' || \
  dpkg -l 2>/dev/null | grep -i llm || \
  echo "[!] Could not determine installed version — check your package manager/container image tag" | tee -a "$REPORT"

# 2) Hunt logs: identities touching many distinct model identifiers (enumeration)
echo -e "\n[2] Top identities by distinct model_id count (last ${LOOKBACK_HOURS}h):" | tee -a "$REPORT"
find "$LOG_DIR" -name '*.log*' -mtime -$((LOOKBACK_HOURS/24 + 1)) -print0 2>/dev/null \
  | xargs -0 zgrep -hoE 'tenant=[a-zA-Z0-9_-]+.*model_?id=[a-zA-Z0-9._-]+' 2>/dev/null \
  | sort | uniq -c | sort -rn | head -50 | tee -a "$REPORT" \
  || echo "[!] No matching log lines — verify log format and retention" | tee -a "$REPORT"

# 3) Explicit mismatch flag if gateway logs it
echo -e "\n[3] Logged tenant-mismatch events:" | tee -a "$REPORT"
find "$LOG_DIR" -name '*.log*' -mtime -$((LOOKBACK_HOURS/24 + 1)) -print0 2>/dev/null \
  | xargs -0 zgrep -hcE 'tenant_mismatch|authorization.*(deny|fail|bypass)|cross.?tenant' 2>/dev/null \
  | paste -sd+ | bc | tee -a "$REPORT" || echo "0" | tee -a "$REPORT"

# 4) Config check: authorization-before-credential-lookup enforcement
echo -e "\n[4] Gateway authorization enforcement settings:" | tee -a "$REPORT"
grep -rniE 'authoriz|tenant_isolation|credential_store|model_acl' \
  /etc/llm-gateway/ ~/.config/llm/ 2>/dev/null | tee -a "$REPORT" \
  || echo "[!] No authz-related config found — manual review required" | tee -a "$REPORT"

echo -e "\n=== ACTION REQUIRED ===" | tee -a "$REPORT"
echo "1. Upgrade llm gateway to the vendor-fixed version per the advisory." | tee -a "$REPORT"
echo "2. ROTATE ALL tenant API keys in the shared credential store — assume any key retrievable via model_id is compromised." | tee -a "$REPORT"
echo "3. Reconcile upstream LLM provider billing per key vs. gateway-accounted usage to quantify theft." | tee -a "$REPORT"
echo "Report written to $REPORT"

Remediation

1. Patch

Apply the vendor fix for CVE-2026-117574 immediately. Monitor the NVD entry and the llm project's security advisories/release notes for the fixed version number and upgrade instructions. If you consume llm via a managed/SaaS provider, open a severity-1 ticket demanding their patch timeline and interim mitigations in writing — you are dependent on their remediation for your tenants' safety.

2. Rotate All Tenant API Keys — Non-Negotiable

Because the flaw injects victim tenant API keys into attacker-influenced requests, you must assume every key in the shared credential store is potentially exposed — not merely abused for quota. Rotate all tenant LLM provider keys, not just keys belonging to tenants you can prove were targeted. Sequence it: patch first (so new keys aren't immediately re-exposable), then rotate, then revoke old keys at the LLM provider side.

3. Enforce Authorization Before Credential Retrieval (Workaround / Defense-in-Depth)

If a patch is not yet available, place compensating controls in front of the gateway:

• WAF/reverse-proxy rule: reject inference requests where the authenticated tenant claim does not match the tenant bound to the requested model field/header. This requires your identity layer to expose a tenant claim the proxy can evaluate — implement it as a deny-by-default mapping table.
• Disable cross-tenant model visibility: if the gateway has a configuration toggle for model ACLs or per-tenant model namespaces, enforce strict scoping so tenant keys can only resolve their own model identifiers.
• Rate-limit and cap: impose per-identity quotas on distinct model identifiers per time window to break enumeration, and hard per-key spend caps at the LLM provider to bound financial blast radius.
• Network segmentation: restrict gateway egress to approved LLM provider endpoints only, limiting what injected credentials can reach.

4. Assess Impact

• Reconcile provider-billed usage per API key against gateway-accounted usage per tenant for at least the last 90 days; divergence indicates theft.
• Review whether attacker-routed requests could have accessed tenant-specific fine-tuned models, system prompts, retrieval contexts, or connected data stores — this may trigger breach-notification obligations.
• Preserve gateway logs now; verify retention covers the exposure window before it rolls off.

5. Strategic Fixes

CVE-2026-117574 is a design lesson, not just a bug: authorization must always precede credential materialization in any multi-tenant broker. Add BOLA/IDOR test cases — cross-tenant identifier substitution in body and headers — to your API security testing program and to procurement requirements for AI gateway products. Given how quickly LLM gateways are being deployed in 2025–2026 with immature tenancy models, expect more findings in this class; architect for tenant isolation as a first-order requirement, not a feature flag.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub