AIKIDO-2026-911016
WolverineFx.MySql is vulnerable to Information Disclosure
59
Medium Risk
This Affects:
WolverineFx.MySqlTL;DR
In MySQL database-per-tenant configurations, the MySQL message store and queue tables resolve to a single configured schema instead of each tenant's own database. Because a MySQL schema is itself a database, every tenant's inbox, outbox, dead-letter, node, saga, and queued-message rows are written to and read from the same shared physical tables. Tenants therefore observe and act on message and persistence data belonging to other tenants, and per-tenant queue depth counts are inflated across tenants. The fix resolves storage and queue tables inside each tenant's own database so tenant data stays isolated.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you configure MySQL persistence with a database-per-tenant multi-tenancy strategy.
Background info
WolverineFx.MySql is vulnerable to Information Disclosure in versions 5.14.0 - 6.24.7.
How to fix this
Upgrade the WolverineFx.MySql library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant