Summary
PubSubManager keys subscriptions only by channel name; the namespace of the publishing/subscribing connection is not part of the key. Tenants in different namespaces who use the same channel name see each other's messages.
Details
src/pub_sub_manager.cpp / include/pub_sub_manager.h: a single global manager, channel→subscriber maps keyed by the raw channel string; no reference to the connection's namespace (ctx->ns / ctx->ns_id) anywhere in the subsystem.- Namespace isolation only prefixes keys (
docs/05-namespaces.md); SUBSCRIBE/PUBLISH/PSUBSCRIBE bypass key prefixing entirely.
- The cross-node fan-out path (
PublishTxRequest → per-node publish_func) carries only channel + message, so the gap is cluster-wide.
Impact
In a multi-tenant deployment, tenant A can receive tenant B's published messages (and vice versa) by subscribing to the same channel name — an information-disclosure hole in the namespace isolation story.
Suggested fix
Scope channels by namespace (prefix the channel with the namespace id at SUBSCRIBE/PUBLISH time, mirroring key prefixing), or document pub/sub as explicitly namespace-global if that is intended.
Found during the module-docs review (#492); see docs/05-namespaces.md and docs/04-scripting-pubsub-blocking.md Gotchas.
🤖 Found with Claude Code
Summary
PubSubManagerkeys subscriptions only by channel name; the namespace of the publishing/subscribing connection is not part of the key. Tenants in different namespaces who use the same channel name see each other's messages.Details
src/pub_sub_manager.cpp/include/pub_sub_manager.h: a single global manager, channel→subscriber maps keyed by the raw channel string; no reference to the connection's namespace (ctx->ns/ctx->ns_id) anywhere in the subsystem.docs/05-namespaces.md); SUBSCRIBE/PUBLISH/PSUBSCRIBE bypass key prefixing entirely.PublishTxRequest→ per-nodepublish_func) carries only channel + message, so the gap is cluster-wide.Impact
In a multi-tenant deployment, tenant A can receive tenant B's published messages (and vice versa) by subscribing to the same channel name — an information-disclosure hole in the namespace isolation story.
Suggested fix
Scope channels by namespace (prefix the channel with the namespace id at SUBSCRIBE/PUBLISH time, mirroring key prefixing), or document pub/sub as explicitly namespace-global if that is intended.
Found during the module-docs review (#492); see
docs/05-namespaces.mdanddocs/04-scripting-pubsub-blocking.mdGotchas.🤖 Found with Claude Code