---
id: "CVE-2026-74841"
kind: "vulnerability"
aliases: ["CVE-2026-74841"]
title: "Multitenant login flow lets unauthenticated requests grow an unbounded cache"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["multitenant", "other", "self-hosted"]
not_affected_if: ["single-tenant"]
published_at: "2026-11-05T15:17:22+00:00"
first_seen_at: "2026-11-05T15:39:22+00:00"
updated_at: "2026-11-05T15:40:57+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-74841", "first_seen_at": "2026-11-05T15:39:22+00:00"}]
exploit_sources: []
---

# Multitenant login flow lets unauthenticated requests grow an unbounded cache

In multitenant deployments, the login and context filters build a per-tenant delegator name from a request-supplied tenant ID and request it before checking the tenant exists. The delegator factory caches every name it is asked for, including failed lookups, so an unauthenticated attacker can send many arbitrary tenant IDs to drive unbounded memory and database load.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-11-05T15:39:22+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-74841

## From the sources

In multitenant deployments, ContextFilter and LoginWorker built a per-tenant delegator name from a request-supplied userTenantId parameter and requested a delegator for it before confirming the tenant existed. DelegatorFactory's internal cache retains every delegator name it is asked to resolve, including ones that fail to resolve, so an unauthenticated attacker could submit a stream of arbitrary tenant IDs to grow this cache without bound, driving unnecessary memory and database load.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_