Red Hat OpenShift AI vllm-orchestrator-gateway Component Logging Vulnerability Allowing Information Disclosure

A vulnerability exists in the vllm-orchestrator-gateway component of Red Hat OpenShift AI. The issue arises because the production binary logs all incoming authorization headers and complete chat payloads, which may include personally identifiable information (PII) and secrets, to persistent logs. This sensitive information, such as bearer tokens and chat content, can be accessed by any user with logging privileges. The vulnerability leads to unauthorized information disclosure, potentially allowing an attacker to collect credentials and sensitive conversation details.

Impact

The vulnerability allows for the unauthorized logging of sensitive data, including bearer tokens and full chat payloads, at a DEBUG level by default. In Red Hat OpenShift environments, these logs are sent to the node journal and cluster logging stack, where they can be accessed by any user with 'pods/log' RBAC within the namespace. This persistent logging of credentials and private conversation content poses a significant risk of information disclosure.

Reproduction

The vulnerability can be reproduced by sending requests to the vllm-orchestrator-gateway component without authentication. The 'Authorization' header and full chat payloads will be logged at a DEBUG level, including PII and secrets, such as bearer tokens. This logged information will be directed to the node journal and cluster logging stack, accessible to users with 'pods/log' RBAC in the namespace.

Remediation

To address this vulnerability, configure the 'RUST_LOG' environment variable for the 'vllm-orchestrator-gateway' component to a level higher than DEBUG, such as 'INFO'. This change will prevent the logging of sensitive authorization headers and full chat payloads to persistent logs. After updating the environment variable, restart the affected pods or services for the change to take effect.