Thinkst Canary CVE-2026-85220

Exploitable ONLY when the Redis service is enabled on the Canary honeypot - the vendor explicitly states the Canary is NOT affected if the Redis service is disabled, which is the primary limiting factor. The attacker must have network reachability to that Redis service (AV:N, PR:N - no authentication or user interaction). AC:H indicates the trigger is not fully reliable/requires specific conditions. Impact is limited to availability of the honeypot's Redis service (A:L); there is no confidentiality or integrity impact and no full-appliance compromise.

This is a genuinely low-priority issue despite being remotely and unauthenticated-reachable. The vendor CVSS 3.1 vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L) yields 3.7 (Low), and the impact is confined to availability only (C:N/I:N/A:L) - CWE-770 uncontrolled resource consumption against the Redis service, not code execution or data exposure. AC:H signals the attack is not trivially reliable, and A:L means degradation rather than total system collapse. No EPSS score, KEV listing, or public POC was provided in the intelligence, so there is no evidence of active exploitation or automation. Exploitation status: no public exploit identified at time of analysis. The signals are internally consistent - a low-complexity-of-consequence, network-reachable but conditionally-exposed DoS - with no conflicting indicators. The only meaningful risk qualifier is the target itself: this is a Thinkst Canary, a honeypot appliance, so a DoS degrades a detection sensor rather than a production service; an attacker who can reach and crash the Redis service may be attempting to blind the honeypot rather than cause business outage. Priority is low; treat as routine patching, prioritized only where Canaries are relied on as active tripwires.

An attacker who can reach a Canary's exposed Redis service over the network sends crafted traffic that triggers uncontrolled resource consumption, causing the honeypot's Redis service to become unavailable (Denial of Service). No authentication is required, but the attack has higher complexity (AC:H) and only affects deployments where the Redis service is enabled. No public exploit code was identified in the provided intelligence.