Mixed tenant vector index
ID |
mixed-tenant-vector-index |
Severity |
high |
Remediation Complexity |
medium |
Remediation Risk |
medium |
Remediation Effort |
medium |
OWASP LLM |
LLM08:2025 — Vector and Embedding Weaknesses |
OWASP ASI |
ASI06:2026 (secondary ASI03:2026) |
Family |
LLM08 — Vector and Embedding Weaknesses |
Red-team vectors |
RAG Poisoning, Data Exfil via Markdown |
Tags |
ai_security |
Description
A single vector index mixes documents from more than one tenant (multiple tenant namespaces are written into the same store) with no per-tenant filter on the retrieval calls. One tenant’s RAG query can then retrieve — and surface — another tenant’s data: a cross-tenant data leak.
Multi-tenant namespaces with query-side filtering is the recommended multi-tenancy pattern and is not flagged; only the missing-filter combination fires. A single-tenant index produces no finding.
Examples
store.add(documents=a, namespace="tenant_a")
store.add(documents=b, namespace="tenant_b")
results = store.similarity_search(query) (1)| 1 | Retrieval with no per-tenant filter over a multi-tenant index — flagged. |
Adding a per-tenant filter (filter={"tenant": current_tenant}) on every retrieval call produces no finding.