CVE-2026-15574 describes a security flaw in the vllm-orchestrator-gateway component of Red Hat OpenShift AI (RHOAI). The production binary logs all incoming authorization headers and full chat payloads to persistent logs without filtering sensitive data. This includes bearer tokens and chat content, which may contain PII and secrets. Because these logs are accessible to any user with logging privileges, the vulnerability results in information disclosure, potentially allowing attackers to harvest credentials and sensitive conversation content. The CVSS 3.1 base score is 7.5 (High), with network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact.

Sensitive data such as bearer tokens and personally identifiable information is written to persistent logs accessible by any user with logging privileges. This can lead to unauthorized disclosure of credentials and sensitive chat content, increasing the risk of credential theft and privacy violations.

Patch status is not yet confirmed — check the vendor advisory at https://access.redhat.com/security/cve/CVE-2026-15574 for current remediation guidance. Until a fix is available, restrict access to logging systems to trusted administrators only to minimize exposure of sensitive information in logs.