stistigmem-node cross-tenant BOLA vulnerability in quarantine review and fix

stistigmem-node: quarantine review surface exposes and mutates other tenants' quarantined facts (cross-tenant BOLA) Vulnerability Overview Description: On multi-tenant stigmem nodes, tenant administrators can list, read, accept, or reject quarantine facts belonging to other tenants. The query and in lack the predicate, and the garden lookup is not tenant-scoped—exposed via the list and management endpoints. Impact: Cross-tenant confidentiality (reading another tenant's quarantined content) and cross-tenant integrity (accepting or rejecting another tenant's facts), achievable with standard user capabilities rather than node-level admin privileges. Affected Configuration: This is a cross-tenant vulnerability. It is exploitable only in deployments running (multiple tenants on a single node). Default single-tenant nodes only have —there is no second tenant for cross-tenant attacks—so it is not exploitable in default deployments. Rated HIGH because the plugin exists to isolate multi-tenant deployments. Scope Severity: High (9.6 / 10) CVSS v4 Base Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Attack Requirements: None - Privileges Required: Low - User Interaction: None - Vulnerable System Impact Metrics: - Confidentiality: High - Integrity: High - Availability: None - Subsequent System Impact Metrics: - Confidentiality: None - Integrity: None - Availability: None Remediation Patch: Fixed in (PR #728). Added to the query and ; garden lookups are now tenant-scoped; any genuine cross-tenant auditing is now gated behind (node superuser) rather than standard user capabilities. Tenant B administrators can no longer list, accept, or reject Tenant A's quarantine facts. Workaround: No workaround other than upgrading to . Single-tenant deployments are unaffected. References Fix: PR #728

Goal Reached Thanks to every supporter — we hit 100%!

stistigmem-node cross-tenant BOLA vulnerability in quarantine review and fix

More from this source