Apache Kvrocks CVE-2026-45188

Q: What is the CVSS score of CVE-2026-45188?

CVE-2026-45188 has a CVSS 4.0 base score of 2.4 (Low). CVSS vector: CVSS:4.0/AV:L/AC:H/AT:N/PR:H/UI:P/VC:L/VI:L/VA:L/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:U/V:X/RE:L/U:Clear. EPSS exploitation probability: 0.1%.

EUVD-2026-39334 LOW

Relative Path Traversal (CWE-23)

2026-06-25

GHSA-mfqh-v96x-m264

Path Traversal Apache

2.4

CVSS 4.0 · Vendor

Severity by source

Vendor (CNA) PRIMARY

2.4 LOW

CVSS:4.0/AV:L/AC:H/AT:N/PR:H/UI:P/VC:L/VI:L/VA:L/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:U/V:X/RE:L/U:Clear

vuln.today AI

8.4 HIGH

Replication is network-based (AV:N) but requires controlling a trusted master node (AC:H, PR:L); successful traversal writes outside the app boundary (S:C), impacting host confidentiality and integrity.

3.1 AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L

Primary rating from Vendor (CNA).

CVSS VectorVendor

CVSS:4.0/AV:L/AC:H/AT:N/PR:H/UI:P/VC:L/VI:L/VA:L/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:U/V:X/RE:L/U:Clear

Attack Vector

Local

Attack Complexity

High

Privileges Required

High

User Interaction

Scope

Lifecycle Timeline

CVSS changed

Jun 25, 2026 - 09:23 NVD

2.4 (LOW)

Analysis Generated

Jun 25, 2026 - 04:46 vuln.today

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

Replication Fullsync in Apache Kvrocks fails to validate filenames transmitted from a master node to a replica during full synchronization, enabling path traversal to arbitrary filesystem locations. Deployments using Kvrocks master-replica replication are affected; standalone instances with no replication configured are not exposed. An attacker who controls or can impersonate a master node can cause a replica to read or write files outside its intended data directory - no public exploit has been identified and this CVE is not listed in the CISA KEV catalog at time of analysis.

Technical ContextAI

Apache Kvrocks is a Redis-protocol-compatible, distributed key-value store that uses RocksDB as its underlying storage engine, commonly deployed as a drop-in Redis replacement where persistence or higher write throughput is prioritized. Its Fullsync mechanism is a bulk replication mode triggered when a replica first connects to a master, or when incremental replication is no longer feasible; it transfers RocksDB SST (Sorted String Table) files from master to replica over the network. The vulnerability resides in this file transfer path: filenames supplied by the master are written to the replica's filesystem without sanitization, placing this flaw in the CWE-22 (Path Traversal) class. Because filenames are attacker-controlled in a trust-the-master model, sequences such as '../../' can escape the designated Kvrocks data directory. No CPE strings or CWE identifiers have been formally assigned by NVD at this time; the classification is inferred from the advisory title.

RemediationAI

Upgrade Apache Kvrocks to the patched version once released by the Apache Security Team - no confirmed fix version number is available in the current pre-NVD disclosure; monitor https://www.openwall.com/lists/oss-security/2026/06/25 and the Apache Kvrocks security page for the exact patched release. As immediate compensating controls, restrict access to the Kvrocks replication port to only known, trusted master node IP addresses using host-based firewall rules (iptables/nftables) or network segmentation - this prevents a rogue master from initiating a Fullsync. Disable replication entirely on instances that do not require it, since standalone deployments are not exposed to this attack surface. Note that restricting at the network layer does not mitigate the vulnerability if an existing trusted master is itself compromised.