A flaw was found in the vllm-orchestrator-gateway component. (CVE-2026-15574)

CVE-2026-15574 describes a flaw in the vllm-orchestrator-gateway component where the production binary logs all incoming authorization headers and full chat payloads to persistent logs. These logs may contain sensitive data such as bearer tokens and personally identifiable information (PII). Because any user with logging privileges can access these logs, the vulnerability results in information disclosure, potentially allowing attackers to harvest credentials and sensitive conversation content. The CVSS 3.1 base score is 7.5, indicating high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact.

The vulnerability allows unauthorized disclosure of sensitive information including bearer tokens and chat content to any user with access to logs. This can lead to credential theft and exposure of private conversation data, compromising confidentiality.

The vendor advisory from Red Hat does not explicitly mention a fix or patch for this specific CVE in the provided content. Therefore, patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict logging privileges to trusted users only to limit exposure of sensitive logs.