python · stigmem-nodeCritical
stigmem-node: Missing tenant isolation in decay sweep endpoint
POST /v1/decay/sweep did not enforce tenant isolation.
What changed
POST /v1/decay/sweep did not enforce tenant isolation. Queries in lifecycle/decay.py lacked tenant_id predicate; caller tenant not threaded into run_decay_sweep or _decay_job_worker. Allowed cross-tenant decay sweep.
Who it affects
Multi-tenant deployments using stigmem-plugin-multi-tenant. Single-tenant (tenant='default') not affected.
What to do today
Upgrade to version 0.9.0a12 or later, which threads identity.tenant_id into sweep and adds AND tenant_id = ? to candidate selectors.
The trail
Collected→
Audited→
Written→
Published