Faktory CVE-2026-63404
HIGHSeverity by source
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local unprivileged account required (PR:L, AV:L); scope changes to root Redis process (S:C); loadmodule grants full code execution so C/I/A all High.
Primary rating from Vendor (github).
CVSS VectorVendor: github
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
Faktory is a language-agnostic background job server. In versions prior to 1.10.0, the embedded Redis bootstrapper is vulnerable to an insecure temporary file flaw that lets a local unprivileged user hijack the Redis configuration and escalate to root. It writes its startup configuration to a fixed, predictable, world-writable path, /tmp/redis.conf, only creating the file if it does not already exist and never validating it on later boots. Because /tmp is world-writable, a local unprivileged user can pre-create /tmp/redis.conf with attacker-chosen Redis directives before Faktory starts, and Faktory will use the planted file verbatim. Faktory only overrides the unixsocket, dir, and logfile options, leaving directives such as bind, protected-mode, requirepass, and loadmodule attacker-controlled. This lets an attacker silently expose the entire job queue over an unauthenticated network port with no visible error to the administrator. Because the official systemd unit runs Faktory, and the redis-server child it spawns, as root, an attacker can also supply a loadmodule directive to execute arbitrary native code in the root-owned Redis process, escalating from a local unprivileged user to root. This issue is fixed in version 1.10.0.
Articles & Coverage 1
AnalysisAI
Local privilege escalation to root is possible in Faktory background job server versions before 1.10.0 through an insecure temporary file flaw in its embedded Redis bootstrapper. The bootstrapper writes Redis startup configuration to the world-writable path /tmp/redis.conf and never validates or overwrites the file on subsequent boots, allowing a local unprivileged user to pre-plant a malicious config before Faktory starts. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) a local unprivileged user account on the target host; (2) Faktory deployed via the official systemd unit file, which runs both Faktory and its redis-server child as root - non-systemd or non-root deployments significantly reduce impact; (3) the ability to write to /tmp, which is world-writable by default on Linux; and (4) Faktory must start or restart after the attacker stages /tmp/redis.conf, providing a reliable window during any reboot or service restart. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 7.3 with vector AV:L/AC:L/AT:P/PR:L reflects a realistic assessment: exploitation requires local unprivileged access and a specific timing condition (AT:P) - the attacker must stage the malicious file before Faktory starts or restarts. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unprivileged local user on a Faktory host creates /tmp/redis.conf containing a loadmodule directive pointing to a compiled shared library they have staged in a world-readable directory, then waits for a routine system reboot or Faktory service restart. When Faktory's bootstrapper runs, it finds the pre-existing /tmp/redis.conf, accepts it verbatim, and passes it to redis-server running as root; Redis loads the attacker's module, granting them a root shell. … |
| Remediation | Upgrade Faktory to version 1.10.0, which is confirmed fixed via the GitHub release at https://github.com/contribsys/faktory/releases/tag/v1.10.0 and the patch commit at https://github.com/contribsys/faktory/commit/0fb44c0a2b3c554857b53563ad0cf61295cd0c41. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all systems running Faktory and document their current versions to identify affected instances. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Privilege escalation to root in the LiteSpeed User-End cPanel Plugin (versions 2.3 through before 2.4.5) lets attackers
UAF in Redis 8.2.1 via crafted Lua scripts by authenticated users. EPSS 12.4%. Patch available.
It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific
Memory Corruption was discovered in the cmsgpack library in the Lua subsystem in Redis before 3.2.12, 4.x before 4.0.10,
Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user
Redis before 2.8.21 and 3.x before 3.0.2 allows remote attackers to execute arbitrary Lua bytecode via the eval command.
A buffer overflow in Redis 3.2.x prior to 3.2.4 causes arbitrary code execution when a crafted command is sent. Rated cr
Code injection in OneUptime monitoring via custom JS monitor using vm module. PoC and patch available.
In applications using jfinal 4.9.08 and below, there is a deserialization vulnerability when using redis,may be vulnerab
An issue was found in Apache Airflow versions 1.10.10 and below. Rated critical severity (CVSS 9.8), this vulnerability
An Integer Overflow issue was discovered in the struct library in the Lua subsystem in Redis before 3.2.12, 4.x before 4
goanother Another Redis Desktop Manager =<1.6.1 is vulnerable to Cross Site Scripting (XSS) via src/components/Setting.v
Same weakness CWE-377 – Insecure Temporary File
View allShare
External POC / Exploit Code
Leaving vuln.today