It doesn’t seem to be a major vulnerability unless you have the ability to guess keys you don’t have access to via hash and get their invalidation notice. You s

It doesn’t seem to be a major vulnerability unless you have the ability to guess keys you don’t have access to via hash and get their invalidation notice. You still would have to force a hash collision, won’t know which key caused the invalidation (unless you can guarantee that there is just your key and their key on the hash), and won’t get new data. All in all it seems pretty minimal, especially since it’s an insider attack where micro services don’t trust each other.