{"id":"CVE-2026-74841","kind":"vulnerability","aliases":["CVE-2026-74841"],"related":[],"title":"Multitenant login flow lets unauthenticated requests grow an unbounded cache","description":"In multitenant deployments, ContextFilter and LoginWorker built a per-tenant delegator name from a request-supplied userTenantId parameter and requested a delegator for it before confirming the tenant existed. DelegatorFactory's internal cache retains every delegator name it is asked to resolve, including ones that fail to resolve, so an unauthenticated attacker could submit a stream of arbitrary tenant IDs to grow this cache without bound, driving unnecessary memory and database load.","summary":"In multitenant deployments, the login and context filters build a per-tenant delegator name from a request-supplied tenant ID and request it before checking the tenant exists. The delegator factory caches every name it is asked for, including failed lookups, so an unauthenticated attacker can send many arbitrary tenant IDs to drive unbounded memory and database load.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["multitenant","other","self-hosted"],"not_affected_if":["single-tenant"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-05T15:17:22+00:00","first_seen_at":"2026-11-05T15:39:22+00:00","triaged_at":"2026-11-05T15:40:57+00:00","updated_at":"2026-11-05T15:40:57+00:00","category":"other","confidence":0.4,"triage":{"at":"2026-11-05T15:40:57Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Multitenant login flow lets unauthenticated requests grow an unbounded cache","impact":"low","summary":"In multitenant deployments, the login and context filters build a per-tenant delegator name from a request-supplied tenant ID and request it before checking the tenant exists. The delegator factory caches every name it is asked for, including failed lookups, so an unauthenticated attacker can send many arbitrary tenant IDs to drive unbounded memory and database load.","audience":"businesses","category":"other","nicknames":[],"who_cares":["multitenant","self-hosted"],"confidence":0.4,"fix_status":"unknown","needs_auth":"no","worst_case":"unbounded memory and database load from unauthenticated requests","analyst_note":"Identify the affected product and fixed versions from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-74841; the sources give no product or version data.","how_to_check":"- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["single-tenant"],"who_is_affected":"Only deployments running in multitenant mode are described as exposed, since the per-tenant delegator lookup is in the multitenant request path. Single-tenant deployments are not described as affected. The sources do not name the product or versions, so the team must confirm whether its deployment uses this multitenant login path.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000686,"input_tokens":4281,"output_tokens":516,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-74841':13A,16A 'arbitrari':72B,141C 'ask':60B,123C 'attack':68B,135C 'bound':149C 'build':30B 'built':88C 'cach':10A,55B,116C,147C 'check':48B 'confirm':109C 'context':28B 'contextfilt':85C 'could':136C 'cve':11A,14A 'databas':80B,154C 'deleg':35B,53B,93C,105C,119C 'delegatorfactori':113C 'deploy':24B,84C 'drive':76B,150C 'everi':56B,118C 'exist':51B,112C 'factori':54B 'fail':63B,129C 'filter':29B 'flow':3A 'grow':7A,145C 'host':21B 'id':43B,74B,143C 'includ':62B,126C 'intern':115C 'let':4A 'load':81B,155C 'login':2A,26B 'loginwork':87C 'lookup':64B 'mani':71B 'memori':78B,152C 'multiten':1A,17B,23B,83C 'name':36B,57B,94C,120C 'one':127C 'paramet':101C 'per':33B,91C 'per-ten':32B,90C 'request':6A,40B,45B,98C,103C 'request-suppli':39B,97C 'resolv':125C,131C 'retain':117C 'self':20B 'self-host':19B 'send':70B 'stream':139C 'submit':137C 'suppli':41B,99C 'tenant':34B,42B,50B,73B,92C,111C,142C 'unauthent':5A,67B,134C 'unbound':9A,77B 'unnecessari':151C 'usertenantid':100C 'without':148C","nicknames":[],"mitigations":[],"who_affected":"Only deployments running in multitenant mode are described as exposed, since the per-tenant delegator lookup is in the multitenant request path. Single-tenant deployments are not described as affected. The sources do not name the product or versions, so the team must confirm whether its deployment uses this multitenant login path.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["multitenant","other","selfhosted","unknown"],"campaign_type":null,"first_public_at":"2026-11-05T15:17:22+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-74841","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74841","severity":null,"published_at":"2026-11-05T15:17:22+00:00","modified_at":"2026-11-05T15:17:22+00:00","first_seen_at":"2026-11-05T15:39:22+00:00","fetched_at":"2026-11-05T15:39:22+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}