Red Hat AI gateway could route another tenant’s model request using their API key

A Red Hat AI gateway component selected stored model credentials using a model identifier supplied by an authenticated caller without validating the model’s tenant ownership.

The requester needed gateway authentication and knowledge or choice of another tenant model identifier; affected builds and patched versions were not established. A request could consume another tenant’s model-provider API credentials through the gateway, potentially charging or using the wrong account.

The advisory does not show plaintext key extraction or provide a proven exploited customer deployment. Enforce model ownership before credential lookup and scope provider keys to the authenticated tenant and model identity.

Evidence interpretation and control boundary. The attacker does not need to obtain the other tenant’s plaintext API key to misuse it. A model identifier selected under an authenticated principal could resolve to another tenant’s provider credential, shifting billing and inference access across tenant boundaries. The advisory does not establish a universal fix image or a real attack count, so patch availability and end-user impact remain unresolved until the product-specific build is identified.