CVE-2026-74841
Last modified
CVE-2026-74841 is a vulnerability of currently unknown severity. In multitenant deployments, ContextFilter and LoginWorker built a per-tenant delegator name from a request-supplied userTenantId parameter and requested a delegator for it before confirming the tenant existed. DelegatorFactory's internal cache retains every delegator name it is asked to resolve, including ones that fail to resolve, so an unauthenticated attacker could submit a stream of arbitrary tenant IDs to grow this cache without bound, driving unnecessary memory and database load.. EPSS estimates a 0.20% chance of exploitation in the next 30 days.
Description
In multitenant deployments, ContextFilter and LoginWorker built a per-tenant delegator name from a request-supplied userTenantId parameter and requested a delegator for it before confirming the tenant existed. DelegatorFactory's internal cache retains every delegator name it is asked to resolve, including ones that fail to resolve, so an unauthenticated attacker could submit a stream of arbitrary tenant IDs to grow this cache without bound, driving unnecessary memory and database load.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache OFBiz | < 24.09.08 |
References
Timeline
- Published
- Last Modified
- Status
- Awaiting Analysis
Frequently Asked Questions
What is CVE-2026-74841?
How severe is CVE-2026-74841?
How do I fix CVE-2026-74841?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-74820ServiceNow has remediated a SQL injection vulnerability that…10
- CVE-2026-7483Local privilege escalation potentially allowed an attacker t…8.5
- CVE-2026-74835The inets application HTTP server httpd fails to enforce a c…8.7
- CVE-2026-74836Allocation of Resources Without Limits or Throttling vulnera…8.7
- CVE-2026-74837Allocation of Resources Without Limits or Throttling vulnera…8.7
- CVE-2026-7484External control of Assumed-Immutable web parameter vulnerab…5.3
- CVE-2026-74842A vulnerability was found in Kira-Pgr PromptShopMCP up to 5b…6.3
- CVE-2026-74843A vulnerability was determined in Wavlink WN531P3 and WN535M…10
- CVE-2026-74845Official Document Management System developed by 2100 Techno…8.8
- CVE-2026-74846Catalyst::Plugin::Authentication versions before 0.10029 for…7.5
- CVE-2026-74848Inconsistent Interpretation of HTTP Requests ('HTTP Request/…7.5
- CVE-2026-74849Zohocorp ManageEngine ADSelfService Plus versions before bui…9.8
Are you affected by CVE-2026-74841?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST