vulns.co
/
GKData.io MCP

Back to Gadgets

RAG chunk from another tenant

Retrieval is an authorization boundary before the model speaks: a shared index that filters tenant after the top-k cut, or that never filters tenant at all, can place another tenant's chunk in the prompt context. This is not prompt injection, which is a…

Tags: rag, tenant, retrieval, authz

Typical severity: P2-P4

What it becomes

Low alone when the index holds only public text, and it becomes cross-tenant disclosure when another tenant's chunk is retrieved into a context you are allowed to see.

Where to look

  • vector index metadata
  • retrieval filters in the application server
  • chunk text in a context you are allowed to inspect

Chains

  • Cross-tenant disclosure: A retrieval for a tenant you own returns a chunk stored for a different tenant because the query filter omits tenant.
  • Context bleed: The tenant filter is applied after the top-k cut, so another tenant's nearer chunk fills the window that is sent onward.

Notes

  • Use tenants and documents you are allowed to create. Do not paste another customer's text into the report. A citation id and a tenant id are enough.
  • If the model refuses to quote the chunk but the retrieval layer already returned it to the application, the boundary failed. Do not recast that as a prompt-injection finding.