Which versions of Apache Kvrocks are affected by CVE-2026-46751?

Apache Kvrocks contains a critical Lua sandbox escape vulnerability allowing authenticated users with EVAL command privileges to execute arbitrary code on the database host.

How to fix or mitigate CVE-2026-46751?

Within 24 hours: Audit all Apache Kvrocks deployments to identify instances with EVAL command enabled and document which user accounts hold EVAL privileges. Within 7 days: Restrict EVAL command access via database ACLs to only essential service accounts; disable EVAL entirely for non-critical workloads. Within 30 days: Evaluate long-term remediation options including vendor timeline for patches, product replacement, or mandatory implementation of network segmentation and enhanced monitoring to reduce blast radius.

Apache Kvrocks CVE-2026-46751

Q: What is the CVSS score of CVE-2026-46751?

CVE-2026-46751 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:D/RE:L/U:Green. EPSS exploitation probability: 0.3%.

EUVD-2026-39333 MEDIUM

2026-06-25

GHSA-5w7q-2f7j-rqmm

Path Traversal Buffer Overflow Apache

5.5

CVSS 4.0 · Vendor

Severity by source

Vendor (CNA) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:D/RE:L/U:Green

vuln.today AI

9.9 CRITICAL

Network-accessible service, low complexity once authenticated; PR:L because EVAL requires a valid user account; S:C because sandbox escape grants host-level impact beyond the database process.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (CNA).

CVSS VectorVendor

CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:D/RE:L/U:Green

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

CVSS changed

Jun 25, 2026 - 09:23 NVD

5.5 (MEDIUM)

Analysis Generated

Jun 25, 2026 - 04:46 vuln.today

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

Articles & Coverage 1

News Critical Lua Sandbox Escape in Apache Kvrocks - CVE-2026-46751 Jun 25, 2026

AnalysisAI

Lua sandbox escape in Apache Kvrocks exposes the host environment to authenticated users who hold EVAL command privileges. The database fails to strip the loadstring function from its Lua scripting environment, which is a standard hardening step in Redis-protocol-compatible systems; retaining it allows a sandboxed Lua script to load and execute arbitrary Lua bytecode dynamically, effectively escaping the intended script isolation. No public exploit code or CISA KEV listing exists at time of analysis; however, sandbox escapes of this class are well-understood and exploitable by any user granted EVAL access.

Technical ContextAI

Apache Kvrocks is a Redis-protocol-compatible distributed key-value store backed by RocksDB. Like Redis, it exposes an EVAL command that runs Lua scripts inside an interpreter that is supposed to be sandboxed - dangerous standard-library functions (filesystem access, OS calls, load/loadstring for dynamic code compilation) are expected to be nil-ed out before scripts execute. CVE-2026-46751 identifies that loadstring - a Lua 5.1 built-in that compiles an arbitrary string as a Lua chunk and returns it as a callable function - has not been removed from the Kvrocks Lua sandbox. This is the same class of omission that produced CVE-2022-0543 in Debian/Ubuntu Redis packages. The root-cause CWE is not yet assigned by NVD, but the class is CWE-693 (Protection Mechanism Failure) or CWE-265 (Privilege Issues), specifically an incomplete sandbox that retains a capability allowing policy bypass. No CPE strings are published yet given pre-NVD status.

RemediationAI

The primary remediation is to upgrade to the patched version of Apache Kvrocks once it is released by the Apache Software Foundation. At time of analysis, an exact fix version has not been independently confirmed - the disclosure is pre-NVD and the oss-security post (https://www.openwall.com/lists/oss-security/2026/06/25) should be monitored for the official advisory. As a compensating control, restrict or revoke EVAL command access for untrusted or low-privilege users; this can typically be done through Kvrocks ACL rules (analogous to Redis ACL nocommands +@all -eval). Trade-off: disabling EVAL breaks any application logic that relies on server-side Lua scripting. Additionally, deploying Kvrocks in a network-segmented environment accessible only to trusted application services reduces the attack surface. Do not expose the Kvrocks port to untrusted networks.