A hard-coded DEBUG logging configuration in Red Hat OpenShift AI leads to the exposure of sensitive authentication headers and conversation data to unauthorized users with log access.

This is an insertion of sensitive information into an externally accessible file or directory (CWE-538). The gateway component logs full authorization headers and chat payloads before filtering occurs, allowing any user with access to cluster logs to intercept sensitive information.

The vulnerability carries a CVSS base score of 7.5, indicating a high risk of sensitive data compromise. Because the logs capture bearer tokens, attackers who gain read access to cluster logs can perform account impersonation or access protected AI model resources, leading to potential data breaches and unauthorized manipulation of AI services.

Immediate Action: Configure the RUST_LOG environment variable for the vllm-orchestrator-gateway component to a level higher than DEBUG, such as INFO, to prevent sensitive data from being written to logs.

Proactive Monitoring: Audit existing cluster logs for any instances of authorization headers or chat payloads that may have been captured while the system was in the vulnerable configuration.

Compensating Controls: Restrict access to cluster logs and observability tools to the minimum necessary personnel to reduce the exposure window while the logging configuration is being remediated.

Public Exploit Available: No (false)

Given the ease of potential credential theft, administrators should prioritize updating the RUST_LOG environment variable immediately. Ensure that logging policies are reviewed to prevent the accidental exposure of sensitive payloads in future deployment cycles.