Redis
Monthly
Denial of service in the Eclipse Vert.x Redis client (io.vertx:vertx-redis-client) affects versions 4.0.0 through 4.5.34, 5.0.0 through 5.0.12, 5.1.0 through 5.1.9, and 5.2.0: the RESP parser trusts a server-declared array, push, or attribute length and pre-allocates that many elements without an upper bound, so a crafted response triggers a massive heap allocation that terminates the Vert.x event-loop thread with OutOfMemoryError and denies service to every connection and verticle sharing that loop. Exploitation is conditional rather than opportunistic - a remote, unauthenticated attacker qualifies only if they control or have compromised the Redis server the client talks to, or if they can occupy a man-in-the-middle position on the client-to-Redis path; neither user interaction nor prior client authentication is required, which is why the assessed vector is AV:N/PR:N but AC:H, and impact is availability-only (no confidentiality or integrity loss). No public exploit code or confirmed active exploitation was identified at time of analysis, and this is a genuine but conditional DoS issue rather than a top-tier emergency.
Authenticated privilege escalation in youlai-boot through version 2.21.1 lets any logged-in user grant administrator-equivalent permissions to their own role by sending a PUT request to /api/v1/roles/{roleId}/menus with arbitrary menu and button permission IDs, after which the application refreshes its Redis-backed permission cache so the elevated rights apply immediately, without re-login or administrator approval. The vulnerability is a missing authorization check (CWE-862) on a role-permission assignment endpoint rather than a memory-safety or injection flaw; exploitation requires a valid authenticated session (CVSS 4.0 PR:L, assessed CVSS:3.1 base 8.7, AV:N/AC:L/PR:L/UI:N, C:H/I:H/A:H), and the built-in GUEST test account shipped with default or demo deployments is explicitly sufficient. There is no confirmed active exploitation (not listed in CISA KEV) and no public exploit identified at time of analysis, though a public technical writeup and the upstream fix commit are available, making this a credible, non-theoretical risk within youlai-boot deployment niches rather than a mass-exploitation threat.
Unauthenticated path traversal in Risesoft Digital-Infrastructure 9.6.5 through 9.6.11 lets any network-reachable attacker read arbitrary files from the server by placing parent-directory ('../') segments in the fullPath and fileName parameters of the fileManager /rest/retrieveFileStream endpoint, which is unauthenticated by design and backed by the Y9FileController.retrieveFileStream handler. Because the traversable location includes application configuration such as application.yml, successful exploitation exposes database, Redis and Nacos credentials - high confidentiality impact with no write or code-execution component. Both the vendor-source reference and the assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N vector (7.5) confirm no authentication or user interaction is required; no public exploit identified at time of analysis, though a public technical write-up describing the traversal is referenced by VulnCheck.
Type confusion in FalkorDB versions before 4.20.0 allows an authenticated client that can issue GRAPH.QUERY to crash the server and, depending on heap layout, potentially disclose or corrupt memory. The flaw lives in the _read_flags handler in src/commands/cmd_dispatcher.c, which accepts a --bolt argument from any client and blindly casts the following Redis string object to a bolt_client_t structure without verifying its origin, so result-set code later dereferences attacker-influenced pointers; the argument is parsed even when the Bolt endpoint is disabled, meaning default installations are exposed. Exploitation requires valid credentials with query-execution rights, and because of the high attack complexity (AC:H) a denial-of-service crash is the most reliable outcome, with memory disclosure or corruption being layout-dependent and not guaranteed; no public exploit code has been identified at time of analysis and the vendor has released a fixed version. This is assessed as a moderate-priority issue rather than an emergency.
Authentication bypass in the FalkorDB Bolt endpoint (src/bolt/bolt_api.c) affects all releases before 4.20.0 and lets a remote, unauthenticated attacker run graph queries without credentials, scored 9.2 Critical under the vendor's CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H) and assessed as high-impact under an independent CVSS 3.1 vector of AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. Exploitation is gated by two concrete preconditions: the operator must have explicitly enabled the Bolt listener by setting BOLT_PORT (disabled by default, so stock deployments are not exposed), and the flaw only fires when the backing Redis answers an empty AUTH probe with an error other than WRONGPASS - specifically LOADING during dataset load, MASTERDOWN during replication failover, or OOM under memory pressure; in steady state with a password configured, the probe returns WRONGPASS and authentication is enforced normally. No public exploit code has been identified and the issue is not in CISA KEV, so the realistic risk sits with intentionally exposed Bolt endpoints that can be driven into those transient Redis states.
Heap memory disclosure and denial of service in FalkorDB before 4.18.4 stem from an out-of-bounds read in the RDB deserialization routine BufferSerializerIOv2_ReadBuffer, which trusts a sub-buffer length field taken from the incoming stream and validates it only with an ASSERT() that is compiled out of release builds. Unauthenticated remote attackers who can drive a Redis replication exchange - for example by acting as a replication master against a network-reachable instance with no requirepass/ACL configured - can supply a crafted RDB stream to read past the end of a heap allocation, crashing the server or leaking heap memory (CVSS 8.8, high confidentiality and availability impact). No public exploit code has been identified at time of analysis, and the vendor has released a fix in FalkorDB 4.18.4, so residual risk is concentrated on unauthenticated, network-exposed deployments that have not yet upgraded.
Stack-based buffer overflow in FalkorDB versions before 4.18.4 allows remote attackers who can issue Redis replication commands - for example against a network-reachable instance with no password configured - to crash the graph database and possibly achieve code execution by supplying a crafted RDB stream whose entity property count is unbounded. The decoder sizes two variable-length arrays on the thread stack from that attacker-controlled count and then fills them with attacker-supplied values, so a single malformed RDB payload overflows the stack (CWE-121). No public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor has released FalkorDB 4.18.4 moving large property sets to the heap; CVSS 4.0 rates this 9.2 with AV:N/AC:H/PR:N/UI:N, where the high attack complexity reflects the difficulty of converting the overflow into reliable arbitrary code execution rather than a denial of service.
Remote attackers who can issue Redis replication commands to a FalkorDB instance before 4.18.1 can trigger a double-free/use-after-free in the RDB graph decoder, causing a denial of service (redis-server crash) or potentially arbitrary code execution in the redis-server process. The root cause is a buffer-size validation in RdbLoadDeletedNodes/RdbLoadDeletedEdges that relies on ASSERT(), which is compiled out in release builds, so a deleted-nodes buffer whose byte length is not a multiple of sizeof(NodeID) passes unchecked, is freed, then read and freed again. Exploitation is unauthenticated (CVSS PR:N) on instances without a password or otherwise reachable by an untrusted replication source; no public exploit code has been identified at time of analysis, and reliable code execution depends on heap layout.
OAuth 2.0 bearer token compromise in Express Gateway through 1.16.11 is possible when a deployment keeps the default crypto.cipherKey value 'sensitiveKey' and an attacker can read the Redis datastore. The attacker can decrypt stored tokenEncrypted values, combine them with stored token IDs, and obtain valid bearer tokens for any user, causing high confidentiality and integrity impact while availability remains unaffected. This is not remotely exploitable without preconditions: the assessed vector requires high privileges (PR:H), a present attack requirement (AT:P), and high complexity (AC:H), and no public exploit was identified at time of analysis; it is not confirmed actively exploited (CISA KEV).
Deserialization of untrusted cache data in IBM Langflow OSS 1.0.0 through 1.12.2 can execute attacker-controlled code with the privileges of the Langflow service process, but only for an attacker who has already obtained two things: the Langflow server secret and write access to the backing Redis instance used as the application cache. Because both prerequisites are effectively gated - the server secret is a trusted signing/trust value and Redis is normally bound to localhost or a private, authenticated network - this is not exploitable by an anonymous remote attacker against a default deployment, which is why the practical risk is lower than the 7.5 base score suggests. No public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV).
Insecure deserialization in the TrueLayer Magento 2 Plugin's Psr16CacheAdapter component allows an attacker who already has write access to the Magento cache backend (Redis or Memcached) to achieve arbitrary code execution via crafted PHP objects. The flaw arises from PHP's unserialize() being called without class restrictions, and exploitation requires both cache-write capability-obtainable through local filesystem access or an exposed cache service-and the presence of a usable gadget chain in the deployed Magento/Adobe Commerce environment. Although rated CVSS 7.5, real-world risk is materially lower because the attack preconditions are stringent; no public exploit code has been identified at time of analysis, and the issue is not confirmed as actively exploited.
Brute-forceable magic-code email login in Plane versions prior to 1.4.0 allows unauthenticated remote attackers to guess a six-digit numeric login code and take over accounts. The verify endpoint extends django.views.View instead of DRF's APIView, so the configured AnonRateThrottle never runs, and there is no per-code attempt counter, no counter invalidation, and no Django-level throttle middleware behind it, leaving roughly 20 bits of OTP entropy with effectively unlimited guesses inside the code's Redis TTL window. There is no public exploit identified at time of analysis and no confirmed active exploitation, but the 9.1 CVSS reflects a full account takeover path (C:H/I:H) with no authentication or user interaction required, and the fix was released in Plane 1.4.0.
n8n deployments running in queue mode can have arbitrary npm packages installed across every cluster worker by an attacker who holds write access to the deployment's Redis instance, bypassing package name validation, permission checks, checksum verification, and npm safety checks in the community-package installation handler. Affected builds are n8n before 1.123.80, 2.0.0 through 2.39.5, and 2.40.0; vendor fixes ship in 1.123.80, 2.39.6, and 2.40.1. No public exploit code has been identified at time of analysis, and practical risk is gated by the network-position prerequisite - the attacker must already be inside the Redis trust boundary - with single-instance 'main' mode deployments unaffected.
An authenticated user who can author raw Twig in page content on Grav CMS 2.0.0 through 2.0.24 can escape the Twig content sandbox and read the site's entire configuration tree, exposing plugin credentials, SMTP and OAuth secrets, Redis passwords, proxy URLs, and the security.* subtree that the sandbox's redaction is designed to hide. The escape works because the `array` filter and its function form are allowlisted in the sandbox without the needs_is_sandboxed guard carried by print_r, vardump, json_encode, yaml_encode and string, and its implementation calls toArray() or an (array) cast without consulting the sandbox method allowlist, so `grav|array` unwraps the raw Pimple dependency-injection container and its private $values. Because the payload is stored in page content, the disclosed configuration is rendered to unauthenticated visitors; exploitation requires the authoring privilege (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) and no public exploit was identified at time of analysis. Grav 1.7 is not affected because it has no Twig content sandbox, and the issue is fixed in Grav 2.0.25.
Authenticated path traversal in the websocket/long-polling session handling of Zammad 7.0.2 and 7.1.0 allows a low-privilege logged-in user to delete arbitrary files and directories on the server with a single crafted request. The client-supplied session (client) identifier is insufficiently validated before being interpolated into internal filesystem paths, so traversal sequences escape the session storage directory - but only on instances using the default file-based session store, since Redis-backed deployments are not affected. Confirmed impact is integrity and availability loss (arbitrary deletion, no read/exfiltration per the assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H); there is no confirmed active exploitation (CISA SSVC exploitation: none) and no public exploit identified at time of analysis, though the flaw is fully automatable. Note that the published CVSS 4.0 score of 8.8 carries PR:N, which overstates ease of access - the independent assessment confirms authentication is mandatory.
Denial of service in NodeRedis redis-parser through 3.0.0 lets a hostile or hijacked Redis endpoint crash the Node.js client process by returning a crafted RESP multi-bulk header whose declared length exceeds 2^32-1, triggering an uncaught RangeError during parsing. The flaw is reachable by unauthenticated remote attackers (CVSS 4.0 AV:N/AC:L/AT:N/PR:N/UI:N) but its impact is strictly availability (VA:H) - no confidentiality, integrity, or scope impact - so a malicious server, a compromised legitimate Redis instance, or an on-path injector in the RESP response stream can only take down the parsing process. Rated 8.7 (HIGH) by CVSS 4.0, with no public exploit identified at time of analysis and no confirmed vendor-released patch, though the issue is publicly tracked upstream.
Denial of service in hiredis post-v1.5.0 (commit 29ea279) occurs when the RESP aggregate parser performs an uncontrolled memory allocation based on an oversized element or length count supplied in a Redis server reply. A hiredis-based client that connects to a malicious or compromised Redis server, or whose unencrypted connection is subject to man-in-the-middle redirection, can be driven into memory exhaustion and crash or unresponsiveness; no authentication on the hiredis side and no user interaction are required. The provided data does not include a CISA KEV entry, and no public exploit identified at time of analysis, so exploitation should be assessed as requiring an attacker-controlled or untrusted Redis endpoint rather than as confirmed active exploitation.
Authenticated remote code execution in OpenC3 COSMOS (Ruby gem 'openc3' versions 5.1.0 through 7.2.1) lets any logged-in user, including one with only low-tier permissions, execute arbitrary Ruby and Python code on the COSMOS server and its per-target decom microservices. COSMOS reads configuration from a user-writable overlay (targets_modified/) before its read-only targets/ tree and then executes that content - rendering it as ERB, eval-ing GENERIC_READ/WRITE_CONVERSION blocks, or require-ing Script Runner procedure files - so an attacker who can write to the overlay via the screen-save or storage-upload endpoints achieves code execution as the openc3 user, which holds Redis and object-store credentials and sits on the internal service network. A working proof-of-concept is published in the vendor GitHub advisory, and the vendor has released 7.3.0 as the fix; no confirmed active exploitation (CISA KEV) has been reported. Reachability is limited on default single-host installs because the shipped docker-compose binds Traefik to 127.0.0.1:2900, so exploitation is realistic on multi-user deployments that expose the web port.
Authenticated OS command injection in OpenC3 COSMOS 5.12.0 through 7.2.1 allows a user with a valid session to run arbitrary operating-system commands as the openc3 service user by writing shell metacharacters into the pypi_url setting and then installing a plugin that carries Python dependency metadata. The injected value is interpolated into a shell backtick inside PluginModel.install_phase2, so commands execute with access to the service's Redis and bucket storage credentials; in the open-source edition any authenticated user can reach both the setting-write and plugin-install operations, whereas the Enterprise edition requires the administrator role, and the vendor has fixed the issue in 7.3.0. There is no CISA KEV listing or confirmed in-the-wild exploitation, but the public vendor advisory GHSA-vp3w-52v9-q57f includes confirmed end-to-end proof-of-concept steps, and the independent assessment rates this as a genuine high-priority issue rather than CVSS inflation.
Denial of service in FalkorDB v4.20.1, the Redis-module graph database, where the GRAPH.EFFECT replication handler in src/effects/effects_apply.c enforced graph-state assumptions with ASSERT() calls instead of proper error handling. Remote attackers who can reach the Redis endpoint and issue GRAPH.EFFECT with an effects buffer referencing a node ID or label schema that does not exist locally trip a reachable assertion and crash the process (CVSS 3.1 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), with impact confined to availability and no data disclosure or integrity effect. No public exploit code or active exploitation has been confirmed at time of analysis, though the attack primitive is simple: a single crafted command against an unauthenticated or credentialed Redis instance. The vendor has published an upstream fix in commit 17cb1f8f0 (PR #2247).
Missing write-command registration for graph.UDF in the FalkorDB Redis module versions 4.20.1 through 4.20.4 allows a client that is already authenticated and authorized to issue module commands (CVSS PR:L, unauthenticated external attackers are not sufficient) to invoke a command that Redis does not treat as a write, producing incorrect behavior in deployments whose correctness depends on write-command semantics such as replication propagation, persistence, and replica handling. The assessed impact is primarily availability (A:H) with a minor integrity effect (I:L) and explicitly no confidentiality impact (C:N), giving a CVSS of 7.1; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the exposed version range is narrow. Note that the supplied 'Information Disclosure' tag is not supported by the assessed vector, which sets C:N and attributes risk almost entirely to availability.
A crafted, attacker-controlled serialized graph payload processed by FalkorDB 4.20.1 through 4.20.4 overflows a buffer in the GraphBLAS matrix decoder (_Decode_GrB_Matrix in /v19/decode_matrix.c), crashing the Redis module process and denying service to the instance. Reaching the flaw requires an authenticated network connection to the FalkorDB/Redis port (CVSS PR:L) plus the ability to submit matrix data into the decode/restore path; no user interaction is needed, and the confirmed outcome is a process-crash DoS rather than code execution or data disclosure. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor-published CVSS 8.8 (C:H/I:H/A:H) overstates impact relative to the availability-only assessment.
A crafted graph query submitted to FalkorDB (Redis module) versions 4.20.1 through 4.20.4 drives an out-of-bounds read in the node_token_count/relation_token_count code path, crashing the module and the Redis process that hosts it - a purely availability-impacting denial of service with no data exposure or code execution. The flaw is network reachable and low complexity; per our independent assessment the practical authentication requirement depends on the deployment, since exploitation is effectively unauthenticated when Redis is exposed without requirepass or ACLs, but requires an attacker to already hold valid query privileges wherever Redis authentication or ACLs are enforced. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and impact is confined to service availability (base 7.5, NVD vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
A stack overflow in the _ValidateUnion_Clauses routine of FalkorDB (a Redis graph module) versions 4.20.1 through 4.20.4 lets a crafted graph query containing a malicious UNION clause crash the database process, producing a denial of service. Per the CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) the flaw is network-reachable, low-complexity, and requires no privileges or user interaction, with impact confined to availability - no confidentiality or integrity loss. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; exploitation nonetheless requires network reachability to the FalkorDB/Redis endpoint, and in hardened deployments with Redis AUTH or ACLs the PR:N assumption may not hold in practice.
Authenticated non-administrator users of ntopng prior to 6.7.260718 can list and download complete system-configuration backups through the REST v2 endpoints get/system/configurations/list_available_backups.lua and download_backup.lua, which lack the administrator authorization check that the vendor's fix adds. Because the backup payload includes the ntopng.user.* Redis key space, the downloaded archive routinely discloses local-user password hashes and, on deployments where those features are configured, API tokens, TOTP secrets and WebAuthn credential material - enabling account takeover via usable or crackable credentials. Exploitation requires only a valid low-privileged login (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N per independent assessment, PR:L means authenticated but not administrative), with no user interaction and no non-default configuration; no public exploit code or active-exploitation activity (CISA KEV) was identified at time of analysis. The vendor's own CVSS of 8.8 with I:H/A:H is judged slightly overstated, since the flaw is an information-disclosure primitive rather than direct integrity or availability loss.
Any authenticated but non-administrator user on ntopng deployments prior to 6.7.260717 can tamper with threat-intelligence blocklists through the REST endpoint POST /lua/rest/v2/edit/system/edit_blacklist.lua, which performed no administrator check before invoking lists_utils.editList. By manipulating the list_name, list_enabled, url, and list_update parameters, a low-privileged account can repoint blocklist downloads to attacker-controlled content, disable existing blocklists, or suppress scheduled updates, with the changes persisted in Redis and reloaded without a lower-level authorization guard. This yields high integrity and availability impact (CVSS 3.1 8.1, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) but no confidentiality loss; no public exploit identified at time of analysis, and the issue is remediated by the vendor-fixed version 6.7.260717.
Cache poisoning in the Open VSX registry allows an unauthenticated remote client to inject attacker-chosen download, signature, and public-key URLs into per-extension metadata that is then served to every other client, so downstream VS Code-compatible editors fetch and install an attacker-supplied VSIX. Exploitation requires the deployment to be reachable directly by clients, or fronted by a reverse proxy that relays rather than overwrites the client's X-Forwarded-Host/X-Forwarded-Proto/X-Forwarded-Prefix headers, with ovsx.server.url left unset and the attacker's source address treated as a trusted proxy (by default only loopback and private ranges are). Because the VSIX download URL, its signature URL and the verifying public key URL are all derived from the same base URL, extension signing provides no protection; poisoned entries persist for the cache lifetime (one hour by default) and spread cluster-wide when ovsx.redis.enabled is set. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, but the prerequisite is a common default deployment shape, so the risk is real and high rather than theoretical.
Heap exhaustion in Netty's Redis array aggregator, as shipped inside Red Hat products such as JBoss Enterprise Application Platform 7, Red Hat Fuse 7, Red Hat Build of Apache Camel for Spring Boot 4, and Red Hat Single Sign-On 7, lets a remote unauthenticated attacker crash the JVM by sending a tiny stream of nested RESP array headers. Because the decoder eagerly allocates an ArrayList sized to the declared array length before any child element arrives, roughly 12 KB of crafted input can reserve about 1.02 billion child slots when the default 1024-level nesting limit and default element limit are in effect; the impact is availability-only, with no data read or modified. Exploitation is limited to deployments that feed attacker-reachable, untrusted RESP/Redis-protocol traffic into the Netty codec with the default constructor; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Crafted RESP replies from a malicious, compromised, or impersonated Redis endpoint crash Node.js processes that use redis-parser through 3.0.0, including applications built on node-redis and ioredis, because repeated nested array headers drive unbounded recursion that exhausts the V8 call stack and raises an uncaught RangeError. The flaw is a client-side parser denial of service: it is unauthenticated on the parsing path (CVSS 4.0 vector PR:N/UI:N, CVSS 3.1 assessment AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and affects default configurations, since recursion depth is not bounded by any setting. Impact is limited to availability - the process terminates without invoking error-handling callbacks - with no confidentiality or integrity effect; the vendor score of 8.7 reflects that high availability impact. No public exploit identified at time of analysis.
Out-of-bounds reads in the Redis Open Source cluster bus packet parser (versions 7.0.0 through 8.8.1) allow an adjacent-network attacker to crash a cluster node or leak small amounts of process memory by sending a crafted PING/PONG/MEET message containing a string-carrying extension that lacks a null terminator. The cluster bus is unauthenticated by default (CVSS PR:N, AV:A), so any peer that can reach a node's cluster bus port can deliver the malformed packet; the behavior is rated CVSS 7.1 with high availability impact and low confidentiality impact. Vendor-released patch: the fix is included in Redis 8.10.0, and no public exploit code has been identified at time of analysis; non-cluster single-node deployments and Redis Software / Redis Enterprise are not affected.
Missing authorization in yshop-crm through 2.1.3 lets any authenticated back-office user, regardless of role or privilege level, invoke the saveRedisSet and getRedisSet endpoints in CrmCustomerController and rewrite the installation-wide Redis keys that drive lead allocation and customer auto-recycling. Because the scheduled CustomerAutoJob consumes those same keys, a low-privilege staff account can disable recycling, block customer creation, or trigger mass customer deletion across the deployment; publicly available exploit code exists (the VulnCheck-referenced CVE request PoC on GitHub), while no active exploitation has been confirmed and the CVE is not listed in CISA KEV. This is a genuine but bounded-priority issue: exploitation requires a valid CRM account (assessed CVSS PR:L, so unauthenticated remote abuse is not possible), and the assessed impact is high integrity loss to shared policy state (I:H) with a limited availability effect (A:L) and no confidentiality loss (C:N - the readable values are configuration/policy keys, not customer records).
Server-side request forgery and root-level code execution in IBM Langflow OSS 1.0.0 through 1.10.0 lets an authenticated user smuggle arbitrary Python through submitted flow components. Because the component validation scanner fails to block socket and urllib imports yet still returns "validated": true, attackers run code as UID=0 to steal AWS credentials via IMDSv1 SSRF, exfiltrate container files, and pivot to internal PostgreSQL and Redis services. Public exploit code exists, though the flaw is not on the CISA KEV list.
RESP protocol command injection in Predis, the popular PHP client for Redis and Valkey, affects versions 3.0.0-RC1 through 3.2.x when pipeline() is used over aggregate cluster or replication connections. Because AbstractAggregateConnection::write() re-splits an already-serialized RESP buffer on CRLF instead of respecting RESP length prefixes, attacker-controlled keys or values containing carriage-return/line-feed bytes are re-parsed as additional Redis commands, enabling shard-wide cache deletion, targeted data reads/writes, or node disruption on clusters and denial-of-service on replication setups. Fixed in 3.3.0; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Use-after-free in Redis's TLS pending-data handler (`tlsProcessPendingData()`) enables remote attackers to potentially execute arbitrary commands at the privilege level of the Redis server process. The flaw spans all major active Redis release lines and is confirmed fixed in versions 6.2.24, 7.2.16, 7.4.11, 8.2.9, 8.4.6, 8.6.6, 8.8.2, and 8.10.1 - exploitation is gated on TLS being explicitly configured, which is non-default. A public proof-of-concept exists; SSVC rates technical impact as total but automation as not feasible, and the vulnerability is not currently listed in CISA KEV.
Local privilege escalation to root is possible in Faktory background job server versions before 1.10.0 through an insecure temporary file flaw in its embedded Redis bootstrapper. The bootstrapper writes Redis startup configuration to the world-writable path /tmp/redis.conf and never validates or overwrites the file on subsequent boots, allowing a local unprivileged user to pre-plant a malicious config before Faktory starts. Because the official systemd unit runs both Faktory and its Redis child process as root, an attacker-supplied loadmodule directive in that config enables arbitrary native code execution as root. No public exploit has been identified at time of analysis, and the issue is fixed in version 1.10.0.
Information disclosure in Grav CMS before 2.0.16 enables authenticated users holding page-edit permission to retrieve sensitive system configuration values - including Redis passwords and other stored credentials - by invoking `config.get()` or `config.toArray()` within Twig templates. The root cause is an incomplete default denylist in the Twig sandbox configuration that fails to block access to the `config` object when the `config_access` feature is enabled. No public exploit has been identified and the vulnerability is not confirmed actively exploited at time of analysis.
Three compounding authentication weaknesses in RansomLook's /login endpoint allow an unauthenticated remote attacker to enumerate valid usernames via response-time differences, conduct unlimited brute-force or credential-stuffing attacks against discovered accounts, and exhaust the application's synchronous Gunicorn worker pool through a sustained login flood causing application-wide denial of service. All versions matching cpe:2.3:a:ransomlook:ransomlook:*:*:*:*:*:*:*:* are affected prior to the upstream fix commit. No public exploit code or CISA KEV listing has been identified at time of analysis; the CVSS 4.0 score of 8.8 is driven by the combination of confidentiality leakage (username enumeration) and high availability impact (worker exhaustion).
Format string injection in Coturn prior to 4.13.0 lets an authenticated TURN user crash the relay server or leak stack memory into Redis by embedding printf-style specifiers in STUN USERNAME or REALM attributes. At nine call sites in ns_ioalib_engine_impl.c, attacker-controlled values pass is_secure_string() validation and are embedded into Redis keys; send_message_to_redis() then passes the composite key as the format argument to redisAsyncCommand(), causing redisvFormatCommand() to read past the va_list. No public exploit identified at time of analysis and no CISA KEV listing; however, the attack surface is reachable by any valid TURN credential holder, including guest or externally-provisioned users in many WebRTC deployments.
Unauthenticated data access and manipulation in ArcadeDB before 26.8.1 arises because the Redis wire-protocol plugin exposes no authentication gate, letting anyone who can reach the Redis port read, write, and delete records across any database on the server. VulnCheck reported the flaw (CWE-306, Missing Authentication) with a CVSS 4.0 base score of 9.3, reflecting network-reachable, no-privilege exploitation with high confidentiality, integrity, and availability impact. No public exploit is identified at time of analysis, and it is not listed in CISA KEV.
Command injection in Dokploy self-hosted PaaS versions prior to 0.29.13 lets an authenticated user with database-service provisioning rights run arbitrary shell commands on managed remote servers. The user-controlled dockerImage field for PostgreSQL, MySQL, MariaDB, MongoDB, Redis, and libSQL services is interpolated unquoted into a 'docker pull ${dockerImage}' command executed over the remote-server code path (execAsyncRemote), enabling shell metacharacter injection. Rated CVSS 9.9 with a scope change; no public exploit or CISA KEV listing is identified, though the patch ships a regression test demonstrating the injection.
Out-of-bounds read in Redis Cluster Bus PING message parsing affects Redis through version 8.8.1, enabling adjacent unauthenticated attackers to trigger denial of service or extract limited heap memory contents. The root cause is in the getPingExtLength() function, which fails to validate extension length fields against the actual remaining buffer size, allowing a crafted gossip-protocol PING packet to drive the parser past the allocated buffer boundary. No public exploit has been identified at time of analysis, and this vulnerability has not been confirmed in the CISA KEV catalog.
Heap-based buffer overflow in Apache Portable Runtime Utility's redis client component allows remote unauthenticated attackers to crash applications that use the library, resulting in a denial of service. Affected versions span APR-util 1.6.0 through 1.6.3; version 1.6.4 resolves the issue per Apache's advisory on the oss-security mailing list. No public exploit code and no CISA KEV listing have been identified at time of analysis, though SSVC classifies the flaw as automatable with partial technical impact, indicating it could be scripted for broad scanning.
Remote code execution in Redis before 8.8.0 is possible when an authenticated attacker can run the RESTORE command with a maliciously crafted serialized stream payload. The payload defines a stream consumer-group PEL in which the same NACK (pending entry) is referenced by two different consumers, so tearing those consumers down (via XGROUP DELCONSUMER or XACK) triggers a CWE-415 double free of the shared NACK object, corrupting the heap. Publicly available exploit code exists, and the flaw stems from an incomplete fix for CVE-2026-25243; it is not listed in CISA KEV, so there is no public exploit identified as actively exploited at time of analysis.
Improper TLS certificate validation in Gitea versions prior to 1.27.0 lets an on-path attacker intercept the internal API channel and steal the static, high-privilege INTERNAL_TOKEN. The internal API HTTP client (modules/private/internal.go) hardcodes InsecureSkipVerify:true with no config override, so gitea serv / gitea hook subprocesses accept any certificate when LOCAL_ROOT_URL uses HTTPS to a non-loopback host. A detailed proof-of-concept is published in the vendor advisory, but there is no evidence of active exploitation; the token grants full control over every /api/internal/* endpoint, including server shutdown, SSH key authorization, and arbitrary git command execution.
Session revocation bypass in Open WebUI 0.9.0 through 0.9.x (deployments configured with Redis) lets a holder of a revoked JWT keep authenticating realtime Socket.IO connections. The flaw stems from first-message authentication for Socket.IO connect, user-join, join-channels, join-note, and the terminal websocket calling decode_token without the Redis-backed is_valid_token revocation check, so logout, forced-logout, or token invalidation does not sever active realtime access. No public exploit is identified at time of analysis and it is not listed in CISA KEV; the fix is version 0.10.0.
Server-side request forgery in the Ruby css_parser gem (< 3.0.0) lets a remote unauthenticated attacker force the parsing server to issue arbitrary HTTP/HTTPS GET requests, and via an attacker-controlled 3xx redirect to a file:// URI, escalate to arbitrary local file disclosure. The flaw sits in CssParser::Parser#read_remote_file, reachable through load_uri! and any add_block! call that supplies base_uri: - Premailer being the canonical consumer - so a single attacker-planted @import url(...) in parsed CSS reaches the sink. Publicly available exploit code exists (author-supplied PoC); there is no public exploit identified as being used in active campaigns, and it is not listed in CISA KEV.
Single-use authorization-code enforcement can be bypassed under concurrency in the better-auth OAuth provider (@better-auth/oauth-provider 1.6.0 through 1.6.10, the embedded plugin in better-auth 1.4.8-beta.7 through 1.6.10, and the legacy oidc-provider and mcp plugins). Because the POST /oauth2/token authorization_code grant redeems the code via a non-atomic find-then-delete, two concurrent requests carrying the same code both pass the read step and each mint a fresh access, refresh, and id token for the original user's scope. No public exploit is identified at time of analysis and it is not in CISA KEV, but the vendor rates it CVSS 4.0 7.6 (High) with high confidentiality and integrity impact.
Server-side request forgery in the @better-auth/sso plugin (versions >= 0.1.0 through < 1.6.11, and 1.7.0-beta.x) lets any authenticated Better Auth session register an OIDC provider with attacker-controlled endpoint URLs, which the auth server then fetches during callback and reflects into the user profile - a non-blind SSRF exposing cloud metadata (IMDS 169.254.169.254), internal APIs, and localhost-bound services like Redis. When trustEmailVerified is enabled it escalates to full account takeover via forged emailVerified claims. Carrying a CVSS 9.6 (scope-changed) rating with no public exploit identified at time of analysis, the flaw was reported by Vaadata and fixed in 1.6.11.
Authentication bypass in the joserfc Python JOSE/JWT library (PyPI, versions <= 1.6.7) lets unauthenticated attackers forge valid HS256/HS384/HS512 tokens whenever the application's verification secret resolves to an empty string or None. Because HMACAlgorithm.verify feeds a zero-length key straight into hmac.new(b"", ...) and OctKey.import_key only warned (never rejected) empty material, an attacker who knows no secret can reproduce the exact digest with HMAC(key=b"") and pass hmac.compare_digest. Publicly available exploit code exists (working PoC in the advisory); the flaw is fixed in 1.6.8. This is the cross-language sibling of ruby-jwt CVE-2026-45363. No EPSS score or CISA KEV listing was provided; no public exploit-in-the-wild is claimed.
Arbitrary code execution in Amazon's AWS Advanced JDBC Wrapper (versions 3.3.0 through 4.0.0) arises from the RemoteQueryCachePlugin deserializing cached query results from Redis or Valkey via a raw ObjectInputStream with no class filtering. An actor able to write to the shared cache can poison entries with a crafted serialized Java object, triggering gadget-chain execution on every application server that later reads that cache entry. No public exploit identified at time of analysis; risk is elevated because a single poisoned cache key fans out to all consuming app servers.
Insecure deserialization (CWE-502) in IBM Langflow OSS versions 1.0.0 through 1.10.0 lets any party with access to the backing Redis store inject a malicious serialized object that Langflow deserializes, yielding arbitrary code execution with full application privileges. Successful exploitation exposes all stored secrets, flow data, and the underlying host, effectively a complete compromise of the Langflow instance. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV; a vendor patch is available per IBM advisory node 7278443.
Cleartext credential disclosure in OpenProject's Storages module (versions prior to 17.3.3 and 17.4.1) writes the userless OneDrive/SharePoint OAuth access_token in plaintext to Rails.cache under the deterministic key storage.<id>.httpx_access_token, refreshed by an hourly cron and every userless-OAuth call. Because none of the supported cache backends (file_store, memcache, redis) encrypts at rest, an attacker who can read the cache backend retrieves the Azure-AD application-tier bearer token via an anonymous memcached/Redis get. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Remote code execution in Spring Statemachine 3.2.0-3.2.4 and 4.0.0-4.0.1 allows authenticated attackers to execute arbitrary code inside the application JVM by injecting malicious serialized Java objects into the Kryo-based persistence backends (JPA, MongoDB, Redis, or ZooKeeper). The flaw stems from deserializing persisted state-machine contexts without enforcing a class allowlist, a classic CWE-502 pattern that has historically yielded reliable gadget-chain exploitation in Java applications. No public exploit identified at time of analysis, but the deserialization sink and Kryo gadget ecosystem make weaponization straightforward once an attacker can write to the persistence store.
Account impersonation in Budibase 3.37.2 through 3.38.x allows attackers with a Slack, Discord, or MS Teams account in the same workspace to silently bind their external chat identity to any authenticated Budibase user who clicks a crafted link. Because the `/api/chat-links/:instance/:token/handoff` endpoint performs a permanent state-changing write with no consent UI and no CSRF token, a successful link grants the attacker full impersonation through the AI chat agent, reading data and triggering automations as the victim. No public exploit identified at time of analysis beyond the detailed proof-of-concept in the GHSA advisory authored by the reporter.
Server-side request forgery in Open WebUI versions 0.9.5 and earlier allows authenticated OAuth users to read arbitrary internal HTTP responses by abusing the `_process_picture_url` function in `backend/open_webui/utils/oauth.py`, which validates only the initial URL and then permits aiohttp's default 10-redirect follow chain to reach internal addresses. The decoded response body is stored in the attacker's `profile_image_url` and retrievable via `GET /api/v1/auths/`, yielding cloud metadata credentials and access to localhost-bound services. Publicly available exploit code exists (detailed sentinel-verified PoC supplied by the reporter); no public exploit identified at time of analysis in the form of weaponized tooling, and the CVE is not on the CISA KEV list.
Memory exhaustion in Netty's RedisArrayAggregator handler (io.netty:netty-codec-redis) allows remote unauthenticated attackers to drain the JVM-wide direct-memory pool by repeatedly opening and closing Redis pipeline connections before RESP array aggregates complete. Affects netty-codec-redis 4.1.x through 4.1.134.Final and 4.2.0.Final through 4.2.14.Final; vendor patches are available in 4.1.135.Final and 4.2.15.Final. No public exploit identified at time of analysis, EPSS is low (0.04%), and the issue is not in CISA KEV.
Remote denial of service in Netty's netty-codec-redis module (versions <= 4.1.134.Final and 4.2.0.Final through 4.2.14.Final) allows unauthenticated attackers to exhaust direct memory by sending crafted RESP protocol payloads lacking the required \r\n terminator across multiple concurrent connections. The RedisDecoder buffers digit streams indefinitely while awaiting a line terminator, eventually triggering OutOfDirectMemoryError and preventing legitimate connections from being processed. No public exploit identified at time of analysis, but the vendor advisory GHSA-6ghj-frrj-jjj3 confirms the issue and patched releases are available.
Denial of service in Netty's netty-codec-redis module (versions <= 4.1.134.Final and 4.2.0.Final through 4.2.14.Final) allows remote unauthenticated attackers to exhaust JVM heap memory by sending Redis payloads with unbounded nested array headers. The RedisArrayAggregator allocates a new AggregateState and ArrayList for every nested array header without enforcing a depth limit, so a continuous stream of `*1\r\n` headers triggers an OutOfMemoryError. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Privilege escalation to root in the LiteSpeed User-End cPanel Plugin (versions 2.3 through before 2.4.5) lets attackers abuse the plugin's Redis enable/disable functionality (the redisAble cpanel_jsonapi_func) to gain elevated, potentially root-level, access on the cPanel host. This flaw is confirmed actively exploited (CISA KEV) with in-the-wild activity observed in May 2026, publicly available exploit code exists (including a GitHub PoC), and the vendor scores it CVSS 4.0 10.0. Notably, the parent LiteSpeed WHM Plugin is not affected - only the end-user cPanel plugin.
Stored cross-site scripting in Budibase self-hosted deployments (versions before 3.38.2) allows any authenticated user with Builder role - or any BASIC/POWER user with table WRITE permission - to upload SVG, HTML, or JavaScript files containing active content via the /api/attachments/process and /api/attachments/:tableId/upload endpoints. The files are stored in the configured object store (MinIO/S3) with their executable MIME types and served via signed URLs, so any end user viewing an attachment triggers script execution in their browser session. Publicly available exploit code exists (detailed PoC in the GHSA advisory); no public exploit identified in active campaigns at time of analysis.
Pre-authenticated remote code execution in Algernon web server (≤ 1.17.6) allows attackers who can place a handler.lua file anywhere in a parent directory of the server root to execute arbitrary Lua - including shell commands via run3() and os.execute - in the server process on the next HTTP request. The flaw stems from DirPage walking up to 100 ancestor directories past the configured server root searching for handler.lua, and the permission middleware does not gate this lookup, so an anonymous GET / suffices to trigger execution. Publicly available exploit code exists (the reporter published three working PoC variants and a live verification against 1.17.6).
Insecure deserialization in Significant-Gravitas AutoGPT platform versions 0.6.34 through 0.6.51 lets an attacker who can poison entries in the shared Redis cache achieve arbitrary command execution inside the backend container. The backend's read path invokes pickle.loads on cache bytes with no HMAC, signature, or schema gate, so any attacker-controlled value reaching that key becomes code on retrieval. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; the vendor shipped a fix in autogpt-platform-beta-v0.6.52.
Authentication bypass in the ruby-jwt gem (versions < 3.2.0) allows remote attackers to forge valid HS256/HS384/HS512 tokens when an application supplies an empty string or nil as the verification key. Because OpenSSL::HMAC.digest happily computes a digest under an empty key and JWT::JWA::Hmac coerces nil to '' without validating, any application whose key lookup degrades to '' (common with Redis misses, ORM string defaults, or `ENV['SECRET'] || ''` patterns) will accept attacker-signed tokens. No public exploit identified at time of analysis, but the vendor advisory (GHSA-c32j-vqhx-rx3x) and the v3.2.0 patch confirm the issue and the trivial forgery primitive.
Budibase's REST datasource integration before version 3.38.1 bypasses IP blacklist security controls through HTTP redirect following. Authenticated Builder-level users can exploit this to access cloud metadata services and internal databases by redirecting requests through attacker-controlled servers, potentially stealing AWS/GCP/Azure credentials. This vulnerability class was previously fixed in automation steps but the REST integration was overlooked, creating an inconsistent security posture.
Broken object-level authorization in Open WebUI allows any authenticated low-privilege user to enumerate and terminate background tasks belonging to other users via GET /api/tasks and POST /api/tasks/stop/{task_id}. Attackers can disrupt system-wide chat generation and background processing by continuously canceling active tasks across the multi-user instance. Publicly available exploit code exists. Vendor-released patch in v0.9.0 restricts global task endpoints to admin-only and introduces a scoped /api/tasks/chat/{chat_id}/stop endpoint for legitimate user-owned task termination. CVSS 7.1 (AV:N/AC:L/PR:L/UI:N) reflects network-accessible, low-complexity exploitation requiring only authenticated low-privilege access, with high availability impact and low confidentiality impact from task enumeration.
Server-Side Request Forgery (SSRF) in Open WebUI versions ≤0.8.12 allows authenticated users with OAuth access to force the server to make HTTP requests to arbitrary internal resources and exfiltrate complete response data. Exploitation requires OAuth-enabled deployments with ENABLE_OAUTH_SIGNUP=true or OAUTH_UPDATE_PICTURE_ON_LOGIN=true. An attacker controls the OAuth provider's 'picture' claim URL, triggering server-side HTTP requests to cloud metadata services (AWS IMDS), localhost services (Redis, Elasticsearch), or internal network endpoints. The full response is base64-encoded and stored in the user's profile_image_url field, enabling complete data exfiltration. Fixed in version 0.9.0 per GitHub advisory GHSA-24c9-2m8q-qhmh. EPSS data not available; no CISA KEV listing indicates limited widespread exploitation, though publicly available proof-of-concept exists in the GitHub advisory.
Server-Side Request Forgery in Budibase self-hosted instances allows authenticated Global Builder users to bypass SSRF protections via trivial substring manipulation in plugin URL uploads. The vulnerability exploits a flawed validation check that accepts any URL containing '.tar.gz' anywhere in the string, enabling requests to internal cloud metadata services (AWS IMDS at 169.254.169.254), CouchDB, Redis, and private network ranges when chained with the BLACKLIST_IPS bypass (CVE-2026-45060) or via HTTP redirect chains. CVSS 7.7 (High) with Changed Scope indicates cross-boundary impact from application to infrastructure layer. Vendor-released patch available in version 3.35.10 per GitHub security advisory GHSA-xh5j-727m-w6gg. EPSS data not available; no CISA KEV listing at time of analysis. Publicly available exploit code exists in researcher's GitHub repository with Docker-based proof-of-concept.
Cross-instance cache poisoning in Open WebUI allows administrators on one instance to inject malicious tool server configurations into shared Redis cache, affecting users on other instances. The vulnerability stems from missing Redis key prefixes on tool_servers and terminal_servers cache entries in backend/open_webui/utils/tools.py. When multiple Open WebUI instances share a Redis backend (a documented multi-region/blue-green deployment pattern), an admin on Instance A can configure a malicious tool server that overwrites Instance B's cache, causing Instance B users to send tool call payloads-containing chat content, user identity, and OAuth tokens-to attacker-controlled servers. Exploitation requires privileged access (CVSS PR:H) but crosses instance boundaries (Scope:Changed), enabling data exfiltration and prompt injection delivery. Vendor-released patch: version 0.9.0 addresses the missing prefix issue.
Heap-based buffer overflow in RedisBloom versions before 2.8.20 enables remote code execution via Redis RESTORE command when authenticated attackers supply malicious serialized payloads. The vulnerability stems from improper validation of deserialized data in the probabilistic data structures module. Exploitation requires Redis authentication and RESTORE command privileges (PR:L), with CVSS 7.7 rating reflecting the authentication requirement despite critical impact potential. No public exploit code or CISA KEV listing identified at time of analysis, though vendor has released security-focused patch 2.8.20.
Remote code execution in RedisTimeSeries versions before 1.12.14 allows authenticated attackers with RESTORE command permissions to execute arbitrary code via crafted serialized payloads. The vulnerability stems from improper validation of data processed through Redis RESTORE command, enabling heap buffer overflow exploitation. Attackers with low-level privileges can achieve complete system compromise (CVSS 7.7, CVSS:4.0 High confidentiality/integrity/availability impact) through network-based attacks with high complexity. No public exploit code or active exploitation confirmed at time of analysis.
Remote code execution in Redis server versions up to 8.6.3 allows authenticated attackers with RESTORE command privileges to execute arbitrary code by submitting maliciously crafted serialized payloads. The vulnerability stems from insufficient validation of serialized values in the RESTORE command, enabling heap-based buffer overflow conditions. Redis released version 8.6.3 to patch this flaw alongside four other critical RCE vulnerabilities. EPSS data not available; no CISA KEV listing identified at time of analysis, suggesting targeted rather than widespread exploitation.
Use-after-free in Redis 7.2.0 through 8.6.2 allows authenticated attackers to achieve remote code execution by exploiting error handling in the unblock client flow. When a blocked client is evicted during command re-execution, the server fails to handle the error return from processCommandAndResetClient, triggering memory corruption. Redis has released version 8.6.3 with a security fix. No public exploit code or CISA KEV listing identified at time of analysis, suggesting limited observed exploitation despite the critical RCE impact.
Privilege escalation in OpenC3 COSMOS allows low-privileged authenticated users to bypass API authorization and perform administrative actions by executing crafted Python or Ruby scripts via the Script Runner widget. Attackers can directly access Redis database (exposing secrets and configuration settings) and the MinIO buckets service (containing logs, configs, and plugins) due to unrestricted container-to-container network access in the Docker deployment. Vendor-released patch available in version 7.0.0-rc3 and confirmed in 7.0.0 stable release. EPSS data not available; no CISA KEV listing indicates targeted rather than widespread exploitation. CVSS 9.6 (Critical) with scope change reflects the container escape-like privilege boundary violation.
Remote unauthenticated code execution in MixPHP Framework 2.x through 2.2.17 allows attackers to execute arbitrary PHP code by injecting malicious serialized objects into Redis-backed session or cache storage. The framework's RedisHandler directly deserializes untrusted data from Redis using PHP's unserialize() function without validation. CVSS 9.8 with network vector, low complexity, and no privileges required. EPSS and KEV status not provided; SSVC framework marks this as automatable with total technical impact, indicating high exploitability despite no confirmed active exploitation at time of analysis.
Authorization bypass in RustFS, a Rust-based S3-compatible object-storage server, lets any authenticated low-privilege account (for example a read-only user) reconfigure event-notification targets because the four handlers in rustfs/src/admin/handlers/event.rs only verify authentication and skip the validate_admin_request admin-action check used by every other admin handler. An attacker can overwrite an admin-defined webhook or MQTT target by name to silently redirect bucket events - containing object keys, bucket names, user identities, and request metadata - to an attacker-controlled endpoint, evade audit logging, and coerce an SSRF health probe from the server. Publicly available exploit code exists (live PoC scripts), but EPSS is very low (0.05%, 15th percentile) and CISA SSVC lists exploitation as none, indicating a real but not-yet-exploited weakness.
Stored cross-site scripting in mailcow dockerized versions before 2026-03b enables remote attackers to execute arbitrary JavaScript in admin sessions by injecting malicious code through unauthenticated Autodiscover requests. The payload persists in Redis and triggers when administrators view Autodiscover logs on the admin dashboard. CVSS 9.3 reflects the network attack vector and high cross-scope impact, though exploitation requires admin interaction (UI:P) and no public exploit has been identified at time of analysis.
Distribution container registry versions ≤3.0.x and ≤2.8.x restore read access to explicitly deleted blobs when Redis blob descriptor caching and storage deletion are both enabled. After an administrator deletes a blob from repository A, the deletion briefly succeeds, but when repository B later accesses the same digest, it repopulates the shared Redis descriptor cache. Repository A then regains unauthorized read access to the deleted blob because stale repository-scoped membership metadata was never invalidated from Redis. This authorization bypass defeats repository-local content revocation with concrete confidentiality impact. CVSS 7.5 (HIGH) with network attack vector, low complexity, and no authentication required. EPSS exploitation probability is very low (0.03%, 9th percentile), suggesting limited real-world targeting despite public POC availability. Vendor-released patch confirms the issue and provides a fix in version 3.1.0.
Unauthenticated remote code execution (RCE) at root level in Aperi'Solve <3.2.1 allows attackers to execute arbitrary commands via unsanitized password input in JPEG upload functionality. Attack requires no authentication (PR:N) and low complexity (AC:L), with CVSS 9.3 critical severity. Publicly available exploit code exists via GitHub advisory. Attackers gain full container compromise with potential pivot to PostgreSQL/Redis databases and, in misconfigured deployments with Docker socket mounts, possible host system takeover. EPSS data not provided, but given unauthenticated network-based vector and public disclosure with fix details, exploitation risk is substantial for exposed instances.
Server-Side Request Forgery in pyLoad-ng allows authenticated users with ADD permissions to read local files via file:// protocol, access internal network services, and exfiltrate cloud metadata. The parse_urls API endpoint fetches arbitrary URLs without protocol validation, enabling attackers to read /etc/passwd, configuration files, SQLite databases, and AWS/GCP metadata endpoints at 169.254.169.254. Error-based responses create a file existence oracle. Multi-protocol support (file://, gopher://, dict://) escalates impact beyond standard HTTP SSRF. CVSS 7.7 reflects network attack vector, low complexity, and scope change with high confidentiality impact. No public exploit code identified at time of analysis, though detailed proof-of-concept included in advisory demonstrates exploitation via curl commands against Docker deployments.
Unauthenticated Server-Side Request Forgery (SSRF) in Ech0's /api/website/title endpoint allows remote attackers to access internal network services, cloud metadata endpoints (AWS IMDSv1 at 169.254.169.254), and localhost-bound resources without authentication. The vulnerability accepts arbitrary URLs via the website_url parameter with zero validation, enabling attackers to probe internal infrastructure and exfiltrate partial response data through HTML title tag extraction. CVSS 7.2 reflects the
Unsafe deserialization in Roundcube Webmail's Redis/Memcache session handler allows unauthenticated remote attackers to write arbitrary files by crafting malicious session data. Affected versions include all 1.6.x before 1.6.14 and all 1.5.x before 1.5.14. While the CVSS score of 3.7 is low and attack complexity is high, the integrity impact (arbitrary file write) poses a real risk to instances using Redis or Memcache for session storage.
Server-Side Request Forgery in PraisonAI's passthrough API allows authenticated remote attackers to access internal cloud metadata services and private network resources. The vulnerability affects the praisonai Python package where the passthrough() and apassthrough() functions accept unvalidated caller-controlled api_base parameters that are directly concatenated and passed to httpx requests. With default AUTH_ENABLED=False configuration, this is remotely exploitable to retrieve EC2 IAM credent
Server-Side Request Forgery (SSRF) in FastGPT's Model Context Protocol (MCP) tools endpoints allows authenticated attackers to probe internal networks, access cloud metadata services (e.g., AWS/GCP instance credentials), and interact with backend databases like MongoDB and Redis. Affects FastGPT versions prior to 4.14.9.5. The vulnerability has CVSS 7.7 (High) with scope change indicating potential lateral movement to other system components. EPSS data not available; no confirmed active exploitation (not in CISA KEV). Public exploit code exists via GitHub security advisory GHSA-x9vj-5m4j-9mfv with technical details and proof-of-concept guidance.
Spring AI Redis vector store implementations expose sensitive data through unescaped TAG field filter injection in versions 1.0.0-1.0.4 and 1.1.0-1.1.3. Unauthenticated remote attackers can craft malicious filter expressions that bypass query boundaries in RediSearch TAG blocks, allowing extraction of unauthorized information from the vector database (CVSS 7.5 High, C:H). No public exploit identified at time of analysis, though the vulnerability is straightforward to exploit given its low attack complexity (AC:L).
The Performance Monitor plugin for WordPress contains a Server-Side Request Forgery (SSRF) vulnerability in its REST API endpoint that allows unauthenticated attackers to make arbitrary web requests to internal services using dangerous protocols including Gopher. Versions up to and including 1.0.6 are affected. This vulnerability can be chained with services like Redis to achieve Remote Code Execution, making it a critical security concern despite the 7.2 CVSS score.
AVideo, an open-source video platform, contains a server-side request forgery (SSRF) vulnerability that allows unauthenticated attackers to bypass URL validation using IPv4-mapped IPv6 addresses (::ffff:x.x.x.x format). The vulnerable endpoint plugin/LiveLinks/proxy.php can be exploited to access cloud metadata services (AWS, GCP, Azure), internal networks, and localhost services without authentication. A detailed proof-of-concept is publicly available demonstrating credential theft from AWS instance metadata, making this a critical risk for cloud-hosted installations.
Budibase, a low-code platform distributed as a Docker/Kubernetes application, contains a Server-Side Request Forgery (SSRF) vulnerability in its REST datasource query preview endpoint. Authenticated admin users can force the server to make HTTP requests to arbitrary URLs including cloud metadata services, internal networks, and Kubernetes APIs. A detailed proof-of-concept exists demonstrating theft of GCP OAuth2 tokens with cloud-platform scope, CouchDB credential extraction, and internal service enumeration. The CVSS score of 8.7 reflects high confidentiality and integrity impact with changed scope, requiring high privileges but low attack complexity.
Code injection in OneUptime monitoring via custom JS monitor using vm module. PoC and patch available.
Laravel Reverb WebSocket server versions 1.6.3 and below have an insecure deserialization vulnerability enabling remote code execution on the backend server.
A vulnerability in the health check RPM of Cisco IOS XR Software could allow an unauthenticated, remote attacker to access the Redis instance that is running within the NOSi container. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Denial of service in the Eclipse Vert.x Redis client (io.vertx:vertx-redis-client) affects versions 4.0.0 through 4.5.34, 5.0.0 through 5.0.12, 5.1.0 through 5.1.9, and 5.2.0: the RESP parser trusts a server-declared array, push, or attribute length and pre-allocates that many elements without an upper bound, so a crafted response triggers a massive heap allocation that terminates the Vert.x event-loop thread with OutOfMemoryError and denies service to every connection and verticle sharing that loop. Exploitation is conditional rather than opportunistic - a remote, unauthenticated attacker qualifies only if they control or have compromised the Redis server the client talks to, or if they can occupy a man-in-the-middle position on the client-to-Redis path; neither user interaction nor prior client authentication is required, which is why the assessed vector is AV:N/PR:N but AC:H, and impact is availability-only (no confidentiality or integrity loss). No public exploit code or confirmed active exploitation was identified at time of analysis, and this is a genuine but conditional DoS issue rather than a top-tier emergency.
Authenticated privilege escalation in youlai-boot through version 2.21.1 lets any logged-in user grant administrator-equivalent permissions to their own role by sending a PUT request to /api/v1/roles/{roleId}/menus with arbitrary menu and button permission IDs, after which the application refreshes its Redis-backed permission cache so the elevated rights apply immediately, without re-login or administrator approval. The vulnerability is a missing authorization check (CWE-862) on a role-permission assignment endpoint rather than a memory-safety or injection flaw; exploitation requires a valid authenticated session (CVSS 4.0 PR:L, assessed CVSS:3.1 base 8.7, AV:N/AC:L/PR:L/UI:N, C:H/I:H/A:H), and the built-in GUEST test account shipped with default or demo deployments is explicitly sufficient. There is no confirmed active exploitation (not listed in CISA KEV) and no public exploit identified at time of analysis, though a public technical writeup and the upstream fix commit are available, making this a credible, non-theoretical risk within youlai-boot deployment niches rather than a mass-exploitation threat.
Unauthenticated path traversal in Risesoft Digital-Infrastructure 9.6.5 through 9.6.11 lets any network-reachable attacker read arbitrary files from the server by placing parent-directory ('../') segments in the fullPath and fileName parameters of the fileManager /rest/retrieveFileStream endpoint, which is unauthenticated by design and backed by the Y9FileController.retrieveFileStream handler. Because the traversable location includes application configuration such as application.yml, successful exploitation exposes database, Redis and Nacos credentials - high confidentiality impact with no write or code-execution component. Both the vendor-source reference and the assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N vector (7.5) confirm no authentication or user interaction is required; no public exploit identified at time of analysis, though a public technical write-up describing the traversal is referenced by VulnCheck.
Type confusion in FalkorDB versions before 4.20.0 allows an authenticated client that can issue GRAPH.QUERY to crash the server and, depending on heap layout, potentially disclose or corrupt memory. The flaw lives in the _read_flags handler in src/commands/cmd_dispatcher.c, which accepts a --bolt argument from any client and blindly casts the following Redis string object to a bolt_client_t structure without verifying its origin, so result-set code later dereferences attacker-influenced pointers; the argument is parsed even when the Bolt endpoint is disabled, meaning default installations are exposed. Exploitation requires valid credentials with query-execution rights, and because of the high attack complexity (AC:H) a denial-of-service crash is the most reliable outcome, with memory disclosure or corruption being layout-dependent and not guaranteed; no public exploit code has been identified at time of analysis and the vendor has released a fixed version. This is assessed as a moderate-priority issue rather than an emergency.
Authentication bypass in the FalkorDB Bolt endpoint (src/bolt/bolt_api.c) affects all releases before 4.20.0 and lets a remote, unauthenticated attacker run graph queries without credentials, scored 9.2 Critical under the vendor's CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H) and assessed as high-impact under an independent CVSS 3.1 vector of AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. Exploitation is gated by two concrete preconditions: the operator must have explicitly enabled the Bolt listener by setting BOLT_PORT (disabled by default, so stock deployments are not exposed), and the flaw only fires when the backing Redis answers an empty AUTH probe with an error other than WRONGPASS - specifically LOADING during dataset load, MASTERDOWN during replication failover, or OOM under memory pressure; in steady state with a password configured, the probe returns WRONGPASS and authentication is enforced normally. No public exploit code has been identified and the issue is not in CISA KEV, so the realistic risk sits with intentionally exposed Bolt endpoints that can be driven into those transient Redis states.
Heap memory disclosure and denial of service in FalkorDB before 4.18.4 stem from an out-of-bounds read in the RDB deserialization routine BufferSerializerIOv2_ReadBuffer, which trusts a sub-buffer length field taken from the incoming stream and validates it only with an ASSERT() that is compiled out of release builds. Unauthenticated remote attackers who can drive a Redis replication exchange - for example by acting as a replication master against a network-reachable instance with no requirepass/ACL configured - can supply a crafted RDB stream to read past the end of a heap allocation, crashing the server or leaking heap memory (CVSS 8.8, high confidentiality and availability impact). No public exploit code has been identified at time of analysis, and the vendor has released a fix in FalkorDB 4.18.4, so residual risk is concentrated on unauthenticated, network-exposed deployments that have not yet upgraded.
Stack-based buffer overflow in FalkorDB versions before 4.18.4 allows remote attackers who can issue Redis replication commands - for example against a network-reachable instance with no password configured - to crash the graph database and possibly achieve code execution by supplying a crafted RDB stream whose entity property count is unbounded. The decoder sizes two variable-length arrays on the thread stack from that attacker-controlled count and then fills them with attacker-supplied values, so a single malformed RDB payload overflows the stack (CWE-121). No public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor has released FalkorDB 4.18.4 moving large property sets to the heap; CVSS 4.0 rates this 9.2 with AV:N/AC:H/PR:N/UI:N, where the high attack complexity reflects the difficulty of converting the overflow into reliable arbitrary code execution rather than a denial of service.
Remote attackers who can issue Redis replication commands to a FalkorDB instance before 4.18.1 can trigger a double-free/use-after-free in the RDB graph decoder, causing a denial of service (redis-server crash) or potentially arbitrary code execution in the redis-server process. The root cause is a buffer-size validation in RdbLoadDeletedNodes/RdbLoadDeletedEdges that relies on ASSERT(), which is compiled out in release builds, so a deleted-nodes buffer whose byte length is not a multiple of sizeof(NodeID) passes unchecked, is freed, then read and freed again. Exploitation is unauthenticated (CVSS PR:N) on instances without a password or otherwise reachable by an untrusted replication source; no public exploit code has been identified at time of analysis, and reliable code execution depends on heap layout.
OAuth 2.0 bearer token compromise in Express Gateway through 1.16.11 is possible when a deployment keeps the default crypto.cipherKey value 'sensitiveKey' and an attacker can read the Redis datastore. The attacker can decrypt stored tokenEncrypted values, combine them with stored token IDs, and obtain valid bearer tokens for any user, causing high confidentiality and integrity impact while availability remains unaffected. This is not remotely exploitable without preconditions: the assessed vector requires high privileges (PR:H), a present attack requirement (AT:P), and high complexity (AC:H), and no public exploit was identified at time of analysis; it is not confirmed actively exploited (CISA KEV).
Deserialization of untrusted cache data in IBM Langflow OSS 1.0.0 through 1.12.2 can execute attacker-controlled code with the privileges of the Langflow service process, but only for an attacker who has already obtained two things: the Langflow server secret and write access to the backing Redis instance used as the application cache. Because both prerequisites are effectively gated - the server secret is a trusted signing/trust value and Redis is normally bound to localhost or a private, authenticated network - this is not exploitable by an anonymous remote attacker against a default deployment, which is why the practical risk is lower than the 7.5 base score suggests. No public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV).
Insecure deserialization in the TrueLayer Magento 2 Plugin's Psr16CacheAdapter component allows an attacker who already has write access to the Magento cache backend (Redis or Memcached) to achieve arbitrary code execution via crafted PHP objects. The flaw arises from PHP's unserialize() being called without class restrictions, and exploitation requires both cache-write capability-obtainable through local filesystem access or an exposed cache service-and the presence of a usable gadget chain in the deployed Magento/Adobe Commerce environment. Although rated CVSS 7.5, real-world risk is materially lower because the attack preconditions are stringent; no public exploit code has been identified at time of analysis, and the issue is not confirmed as actively exploited.
Brute-forceable magic-code email login in Plane versions prior to 1.4.0 allows unauthenticated remote attackers to guess a six-digit numeric login code and take over accounts. The verify endpoint extends django.views.View instead of DRF's APIView, so the configured AnonRateThrottle never runs, and there is no per-code attempt counter, no counter invalidation, and no Django-level throttle middleware behind it, leaving roughly 20 bits of OTP entropy with effectively unlimited guesses inside the code's Redis TTL window. There is no public exploit identified at time of analysis and no confirmed active exploitation, but the 9.1 CVSS reflects a full account takeover path (C:H/I:H) with no authentication or user interaction required, and the fix was released in Plane 1.4.0.
n8n deployments running in queue mode can have arbitrary npm packages installed across every cluster worker by an attacker who holds write access to the deployment's Redis instance, bypassing package name validation, permission checks, checksum verification, and npm safety checks in the community-package installation handler. Affected builds are n8n before 1.123.80, 2.0.0 through 2.39.5, and 2.40.0; vendor fixes ship in 1.123.80, 2.39.6, and 2.40.1. No public exploit code has been identified at time of analysis, and practical risk is gated by the network-position prerequisite - the attacker must already be inside the Redis trust boundary - with single-instance 'main' mode deployments unaffected.
An authenticated user who can author raw Twig in page content on Grav CMS 2.0.0 through 2.0.24 can escape the Twig content sandbox and read the site's entire configuration tree, exposing plugin credentials, SMTP and OAuth secrets, Redis passwords, proxy URLs, and the security.* subtree that the sandbox's redaction is designed to hide. The escape works because the `array` filter and its function form are allowlisted in the sandbox without the needs_is_sandboxed guard carried by print_r, vardump, json_encode, yaml_encode and string, and its implementation calls toArray() or an (array) cast without consulting the sandbox method allowlist, so `grav|array` unwraps the raw Pimple dependency-injection container and its private $values. Because the payload is stored in page content, the disclosed configuration is rendered to unauthenticated visitors; exploitation requires the authoring privilege (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) and no public exploit was identified at time of analysis. Grav 1.7 is not affected because it has no Twig content sandbox, and the issue is fixed in Grav 2.0.25.
Authenticated path traversal in the websocket/long-polling session handling of Zammad 7.0.2 and 7.1.0 allows a low-privilege logged-in user to delete arbitrary files and directories on the server with a single crafted request. The client-supplied session (client) identifier is insufficiently validated before being interpolated into internal filesystem paths, so traversal sequences escape the session storage directory - but only on instances using the default file-based session store, since Redis-backed deployments are not affected. Confirmed impact is integrity and availability loss (arbitrary deletion, no read/exfiltration per the assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H); there is no confirmed active exploitation (CISA SSVC exploitation: none) and no public exploit identified at time of analysis, though the flaw is fully automatable. Note that the published CVSS 4.0 score of 8.8 carries PR:N, which overstates ease of access - the independent assessment confirms authentication is mandatory.
Denial of service in NodeRedis redis-parser through 3.0.0 lets a hostile or hijacked Redis endpoint crash the Node.js client process by returning a crafted RESP multi-bulk header whose declared length exceeds 2^32-1, triggering an uncaught RangeError during parsing. The flaw is reachable by unauthenticated remote attackers (CVSS 4.0 AV:N/AC:L/AT:N/PR:N/UI:N) but its impact is strictly availability (VA:H) - no confidentiality, integrity, or scope impact - so a malicious server, a compromised legitimate Redis instance, or an on-path injector in the RESP response stream can only take down the parsing process. Rated 8.7 (HIGH) by CVSS 4.0, with no public exploit identified at time of analysis and no confirmed vendor-released patch, though the issue is publicly tracked upstream.
Denial of service in hiredis post-v1.5.0 (commit 29ea279) occurs when the RESP aggregate parser performs an uncontrolled memory allocation based on an oversized element or length count supplied in a Redis server reply. A hiredis-based client that connects to a malicious or compromised Redis server, or whose unencrypted connection is subject to man-in-the-middle redirection, can be driven into memory exhaustion and crash or unresponsiveness; no authentication on the hiredis side and no user interaction are required. The provided data does not include a CISA KEV entry, and no public exploit identified at time of analysis, so exploitation should be assessed as requiring an attacker-controlled or untrusted Redis endpoint rather than as confirmed active exploitation.
Authenticated remote code execution in OpenC3 COSMOS (Ruby gem 'openc3' versions 5.1.0 through 7.2.1) lets any logged-in user, including one with only low-tier permissions, execute arbitrary Ruby and Python code on the COSMOS server and its per-target decom microservices. COSMOS reads configuration from a user-writable overlay (targets_modified/) before its read-only targets/ tree and then executes that content - rendering it as ERB, eval-ing GENERIC_READ/WRITE_CONVERSION blocks, or require-ing Script Runner procedure files - so an attacker who can write to the overlay via the screen-save or storage-upload endpoints achieves code execution as the openc3 user, which holds Redis and object-store credentials and sits on the internal service network. A working proof-of-concept is published in the vendor GitHub advisory, and the vendor has released 7.3.0 as the fix; no confirmed active exploitation (CISA KEV) has been reported. Reachability is limited on default single-host installs because the shipped docker-compose binds Traefik to 127.0.0.1:2900, so exploitation is realistic on multi-user deployments that expose the web port.
Authenticated OS command injection in OpenC3 COSMOS 5.12.0 through 7.2.1 allows a user with a valid session to run arbitrary operating-system commands as the openc3 service user by writing shell metacharacters into the pypi_url setting and then installing a plugin that carries Python dependency metadata. The injected value is interpolated into a shell backtick inside PluginModel.install_phase2, so commands execute with access to the service's Redis and bucket storage credentials; in the open-source edition any authenticated user can reach both the setting-write and plugin-install operations, whereas the Enterprise edition requires the administrator role, and the vendor has fixed the issue in 7.3.0. There is no CISA KEV listing or confirmed in-the-wild exploitation, but the public vendor advisory GHSA-vp3w-52v9-q57f includes confirmed end-to-end proof-of-concept steps, and the independent assessment rates this as a genuine high-priority issue rather than CVSS inflation.
Denial of service in FalkorDB v4.20.1, the Redis-module graph database, where the GRAPH.EFFECT replication handler in src/effects/effects_apply.c enforced graph-state assumptions with ASSERT() calls instead of proper error handling. Remote attackers who can reach the Redis endpoint and issue GRAPH.EFFECT with an effects buffer referencing a node ID or label schema that does not exist locally trip a reachable assertion and crash the process (CVSS 3.1 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), with impact confined to availability and no data disclosure or integrity effect. No public exploit code or active exploitation has been confirmed at time of analysis, though the attack primitive is simple: a single crafted command against an unauthenticated or credentialed Redis instance. The vendor has published an upstream fix in commit 17cb1f8f0 (PR #2247).
Missing write-command registration for graph.UDF in the FalkorDB Redis module versions 4.20.1 through 4.20.4 allows a client that is already authenticated and authorized to issue module commands (CVSS PR:L, unauthenticated external attackers are not sufficient) to invoke a command that Redis does not treat as a write, producing incorrect behavior in deployments whose correctness depends on write-command semantics such as replication propagation, persistence, and replica handling. The assessed impact is primarily availability (A:H) with a minor integrity effect (I:L) and explicitly no confidentiality impact (C:N), giving a CVSS of 7.1; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the exposed version range is narrow. Note that the supplied 'Information Disclosure' tag is not supported by the assessed vector, which sets C:N and attributes risk almost entirely to availability.
A crafted, attacker-controlled serialized graph payload processed by FalkorDB 4.20.1 through 4.20.4 overflows a buffer in the GraphBLAS matrix decoder (_Decode_GrB_Matrix in /v19/decode_matrix.c), crashing the Redis module process and denying service to the instance. Reaching the flaw requires an authenticated network connection to the FalkorDB/Redis port (CVSS PR:L) plus the ability to submit matrix data into the decode/restore path; no user interaction is needed, and the confirmed outcome is a process-crash DoS rather than code execution or data disclosure. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor-published CVSS 8.8 (C:H/I:H/A:H) overstates impact relative to the availability-only assessment.
A crafted graph query submitted to FalkorDB (Redis module) versions 4.20.1 through 4.20.4 drives an out-of-bounds read in the node_token_count/relation_token_count code path, crashing the module and the Redis process that hosts it - a purely availability-impacting denial of service with no data exposure or code execution. The flaw is network reachable and low complexity; per our independent assessment the practical authentication requirement depends on the deployment, since exploitation is effectively unauthenticated when Redis is exposed without requirepass or ACLs, but requires an attacker to already hold valid query privileges wherever Redis authentication or ACLs are enforced. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and impact is confined to service availability (base 7.5, NVD vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
A stack overflow in the _ValidateUnion_Clauses routine of FalkorDB (a Redis graph module) versions 4.20.1 through 4.20.4 lets a crafted graph query containing a malicious UNION clause crash the database process, producing a denial of service. Per the CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) the flaw is network-reachable, low-complexity, and requires no privileges or user interaction, with impact confined to availability - no confidentiality or integrity loss. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; exploitation nonetheless requires network reachability to the FalkorDB/Redis endpoint, and in hardened deployments with Redis AUTH or ACLs the PR:N assumption may not hold in practice.
Authenticated non-administrator users of ntopng prior to 6.7.260718 can list and download complete system-configuration backups through the REST v2 endpoints get/system/configurations/list_available_backups.lua and download_backup.lua, which lack the administrator authorization check that the vendor's fix adds. Because the backup payload includes the ntopng.user.* Redis key space, the downloaded archive routinely discloses local-user password hashes and, on deployments where those features are configured, API tokens, TOTP secrets and WebAuthn credential material - enabling account takeover via usable or crackable credentials. Exploitation requires only a valid low-privileged login (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N per independent assessment, PR:L means authenticated but not administrative), with no user interaction and no non-default configuration; no public exploit code or active-exploitation activity (CISA KEV) was identified at time of analysis. The vendor's own CVSS of 8.8 with I:H/A:H is judged slightly overstated, since the flaw is an information-disclosure primitive rather than direct integrity or availability loss.
Any authenticated but non-administrator user on ntopng deployments prior to 6.7.260717 can tamper with threat-intelligence blocklists through the REST endpoint POST /lua/rest/v2/edit/system/edit_blacklist.lua, which performed no administrator check before invoking lists_utils.editList. By manipulating the list_name, list_enabled, url, and list_update parameters, a low-privileged account can repoint blocklist downloads to attacker-controlled content, disable existing blocklists, or suppress scheduled updates, with the changes persisted in Redis and reloaded without a lower-level authorization guard. This yields high integrity and availability impact (CVSS 3.1 8.1, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) but no confidentiality loss; no public exploit identified at time of analysis, and the issue is remediated by the vendor-fixed version 6.7.260717.
Cache poisoning in the Open VSX registry allows an unauthenticated remote client to inject attacker-chosen download, signature, and public-key URLs into per-extension metadata that is then served to every other client, so downstream VS Code-compatible editors fetch and install an attacker-supplied VSIX. Exploitation requires the deployment to be reachable directly by clients, or fronted by a reverse proxy that relays rather than overwrites the client's X-Forwarded-Host/X-Forwarded-Proto/X-Forwarded-Prefix headers, with ovsx.server.url left unset and the attacker's source address treated as a trusted proxy (by default only loopback and private ranges are). Because the VSIX download URL, its signature URL and the verifying public key URL are all derived from the same base URL, extension signing provides no protection; poisoned entries persist for the cache lifetime (one hour by default) and spread cluster-wide when ovsx.redis.enabled is set. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, but the prerequisite is a common default deployment shape, so the risk is real and high rather than theoretical.
Heap exhaustion in Netty's Redis array aggregator, as shipped inside Red Hat products such as JBoss Enterprise Application Platform 7, Red Hat Fuse 7, Red Hat Build of Apache Camel for Spring Boot 4, and Red Hat Single Sign-On 7, lets a remote unauthenticated attacker crash the JVM by sending a tiny stream of nested RESP array headers. Because the decoder eagerly allocates an ArrayList sized to the declared array length before any child element arrives, roughly 12 KB of crafted input can reserve about 1.02 billion child slots when the default 1024-level nesting limit and default element limit are in effect; the impact is availability-only, with no data read or modified. Exploitation is limited to deployments that feed attacker-reachable, untrusted RESP/Redis-protocol traffic into the Netty codec with the default constructor; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Crafted RESP replies from a malicious, compromised, or impersonated Redis endpoint crash Node.js processes that use redis-parser through 3.0.0, including applications built on node-redis and ioredis, because repeated nested array headers drive unbounded recursion that exhausts the V8 call stack and raises an uncaught RangeError. The flaw is a client-side parser denial of service: it is unauthenticated on the parsing path (CVSS 4.0 vector PR:N/UI:N, CVSS 3.1 assessment AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and affects default configurations, since recursion depth is not bounded by any setting. Impact is limited to availability - the process terminates without invoking error-handling callbacks - with no confidentiality or integrity effect; the vendor score of 8.7 reflects that high availability impact. No public exploit identified at time of analysis.
Out-of-bounds reads in the Redis Open Source cluster bus packet parser (versions 7.0.0 through 8.8.1) allow an adjacent-network attacker to crash a cluster node or leak small amounts of process memory by sending a crafted PING/PONG/MEET message containing a string-carrying extension that lacks a null terminator. The cluster bus is unauthenticated by default (CVSS PR:N, AV:A), so any peer that can reach a node's cluster bus port can deliver the malformed packet; the behavior is rated CVSS 7.1 with high availability impact and low confidentiality impact. Vendor-released patch: the fix is included in Redis 8.10.0, and no public exploit code has been identified at time of analysis; non-cluster single-node deployments and Redis Software / Redis Enterprise are not affected.
Missing authorization in yshop-crm through 2.1.3 lets any authenticated back-office user, regardless of role or privilege level, invoke the saveRedisSet and getRedisSet endpoints in CrmCustomerController and rewrite the installation-wide Redis keys that drive lead allocation and customer auto-recycling. Because the scheduled CustomerAutoJob consumes those same keys, a low-privilege staff account can disable recycling, block customer creation, or trigger mass customer deletion across the deployment; publicly available exploit code exists (the VulnCheck-referenced CVE request PoC on GitHub), while no active exploitation has been confirmed and the CVE is not listed in CISA KEV. This is a genuine but bounded-priority issue: exploitation requires a valid CRM account (assessed CVSS PR:L, so unauthenticated remote abuse is not possible), and the assessed impact is high integrity loss to shared policy state (I:H) with a limited availability effect (A:L) and no confidentiality loss (C:N - the readable values are configuration/policy keys, not customer records).
Server-side request forgery and root-level code execution in IBM Langflow OSS 1.0.0 through 1.10.0 lets an authenticated user smuggle arbitrary Python through submitted flow components. Because the component validation scanner fails to block socket and urllib imports yet still returns "validated": true, attackers run code as UID=0 to steal AWS credentials via IMDSv1 SSRF, exfiltrate container files, and pivot to internal PostgreSQL and Redis services. Public exploit code exists, though the flaw is not on the CISA KEV list.
RESP protocol command injection in Predis, the popular PHP client for Redis and Valkey, affects versions 3.0.0-RC1 through 3.2.x when pipeline() is used over aggregate cluster or replication connections. Because AbstractAggregateConnection::write() re-splits an already-serialized RESP buffer on CRLF instead of respecting RESP length prefixes, attacker-controlled keys or values containing carriage-return/line-feed bytes are re-parsed as additional Redis commands, enabling shard-wide cache deletion, targeted data reads/writes, or node disruption on clusters and denial-of-service on replication setups. Fixed in 3.3.0; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Use-after-free in Redis's TLS pending-data handler (`tlsProcessPendingData()`) enables remote attackers to potentially execute arbitrary commands at the privilege level of the Redis server process. The flaw spans all major active Redis release lines and is confirmed fixed in versions 6.2.24, 7.2.16, 7.4.11, 8.2.9, 8.4.6, 8.6.6, 8.8.2, and 8.10.1 - exploitation is gated on TLS being explicitly configured, which is non-default. A public proof-of-concept exists; SSVC rates technical impact as total but automation as not feasible, and the vulnerability is not currently listed in CISA KEV.
Local privilege escalation to root is possible in Faktory background job server versions before 1.10.0 through an insecure temporary file flaw in its embedded Redis bootstrapper. The bootstrapper writes Redis startup configuration to the world-writable path /tmp/redis.conf and never validates or overwrites the file on subsequent boots, allowing a local unprivileged user to pre-plant a malicious config before Faktory starts. Because the official systemd unit runs both Faktory and its Redis child process as root, an attacker-supplied loadmodule directive in that config enables arbitrary native code execution as root. No public exploit has been identified at time of analysis, and the issue is fixed in version 1.10.0.
Information disclosure in Grav CMS before 2.0.16 enables authenticated users holding page-edit permission to retrieve sensitive system configuration values - including Redis passwords and other stored credentials - by invoking `config.get()` or `config.toArray()` within Twig templates. The root cause is an incomplete default denylist in the Twig sandbox configuration that fails to block access to the `config` object when the `config_access` feature is enabled. No public exploit has been identified and the vulnerability is not confirmed actively exploited at time of analysis.
Three compounding authentication weaknesses in RansomLook's /login endpoint allow an unauthenticated remote attacker to enumerate valid usernames via response-time differences, conduct unlimited brute-force or credential-stuffing attacks against discovered accounts, and exhaust the application's synchronous Gunicorn worker pool through a sustained login flood causing application-wide denial of service. All versions matching cpe:2.3:a:ransomlook:ransomlook:*:*:*:*:*:*:*:* are affected prior to the upstream fix commit. No public exploit code or CISA KEV listing has been identified at time of analysis; the CVSS 4.0 score of 8.8 is driven by the combination of confidentiality leakage (username enumeration) and high availability impact (worker exhaustion).
Format string injection in Coturn prior to 4.13.0 lets an authenticated TURN user crash the relay server or leak stack memory into Redis by embedding printf-style specifiers in STUN USERNAME or REALM attributes. At nine call sites in ns_ioalib_engine_impl.c, attacker-controlled values pass is_secure_string() validation and are embedded into Redis keys; send_message_to_redis() then passes the composite key as the format argument to redisAsyncCommand(), causing redisvFormatCommand() to read past the va_list. No public exploit identified at time of analysis and no CISA KEV listing; however, the attack surface is reachable by any valid TURN credential holder, including guest or externally-provisioned users in many WebRTC deployments.
Unauthenticated data access and manipulation in ArcadeDB before 26.8.1 arises because the Redis wire-protocol plugin exposes no authentication gate, letting anyone who can reach the Redis port read, write, and delete records across any database on the server. VulnCheck reported the flaw (CWE-306, Missing Authentication) with a CVSS 4.0 base score of 9.3, reflecting network-reachable, no-privilege exploitation with high confidentiality, integrity, and availability impact. No public exploit is identified at time of analysis, and it is not listed in CISA KEV.
Command injection in Dokploy self-hosted PaaS versions prior to 0.29.13 lets an authenticated user with database-service provisioning rights run arbitrary shell commands on managed remote servers. The user-controlled dockerImage field for PostgreSQL, MySQL, MariaDB, MongoDB, Redis, and libSQL services is interpolated unquoted into a 'docker pull ${dockerImage}' command executed over the remote-server code path (execAsyncRemote), enabling shell metacharacter injection. Rated CVSS 9.9 with a scope change; no public exploit or CISA KEV listing is identified, though the patch ships a regression test demonstrating the injection.
Out-of-bounds read in Redis Cluster Bus PING message parsing affects Redis through version 8.8.1, enabling adjacent unauthenticated attackers to trigger denial of service or extract limited heap memory contents. The root cause is in the getPingExtLength() function, which fails to validate extension length fields against the actual remaining buffer size, allowing a crafted gossip-protocol PING packet to drive the parser past the allocated buffer boundary. No public exploit has been identified at time of analysis, and this vulnerability has not been confirmed in the CISA KEV catalog.
Heap-based buffer overflow in Apache Portable Runtime Utility's redis client component allows remote unauthenticated attackers to crash applications that use the library, resulting in a denial of service. Affected versions span APR-util 1.6.0 through 1.6.3; version 1.6.4 resolves the issue per Apache's advisory on the oss-security mailing list. No public exploit code and no CISA KEV listing have been identified at time of analysis, though SSVC classifies the flaw as automatable with partial technical impact, indicating it could be scripted for broad scanning.
Remote code execution in Redis before 8.8.0 is possible when an authenticated attacker can run the RESTORE command with a maliciously crafted serialized stream payload. The payload defines a stream consumer-group PEL in which the same NACK (pending entry) is referenced by two different consumers, so tearing those consumers down (via XGROUP DELCONSUMER or XACK) triggers a CWE-415 double free of the shared NACK object, corrupting the heap. Publicly available exploit code exists, and the flaw stems from an incomplete fix for CVE-2026-25243; it is not listed in CISA KEV, so there is no public exploit identified as actively exploited at time of analysis.
Improper TLS certificate validation in Gitea versions prior to 1.27.0 lets an on-path attacker intercept the internal API channel and steal the static, high-privilege INTERNAL_TOKEN. The internal API HTTP client (modules/private/internal.go) hardcodes InsecureSkipVerify:true with no config override, so gitea serv / gitea hook subprocesses accept any certificate when LOCAL_ROOT_URL uses HTTPS to a non-loopback host. A detailed proof-of-concept is published in the vendor advisory, but there is no evidence of active exploitation; the token grants full control over every /api/internal/* endpoint, including server shutdown, SSH key authorization, and arbitrary git command execution.
Session revocation bypass in Open WebUI 0.9.0 through 0.9.x (deployments configured with Redis) lets a holder of a revoked JWT keep authenticating realtime Socket.IO connections. The flaw stems from first-message authentication for Socket.IO connect, user-join, join-channels, join-note, and the terminal websocket calling decode_token without the Redis-backed is_valid_token revocation check, so logout, forced-logout, or token invalidation does not sever active realtime access. No public exploit is identified at time of analysis and it is not listed in CISA KEV; the fix is version 0.10.0.
Server-side request forgery in the Ruby css_parser gem (< 3.0.0) lets a remote unauthenticated attacker force the parsing server to issue arbitrary HTTP/HTTPS GET requests, and via an attacker-controlled 3xx redirect to a file:// URI, escalate to arbitrary local file disclosure. The flaw sits in CssParser::Parser#read_remote_file, reachable through load_uri! and any add_block! call that supplies base_uri: - Premailer being the canonical consumer - so a single attacker-planted @import url(...) in parsed CSS reaches the sink. Publicly available exploit code exists (author-supplied PoC); there is no public exploit identified as being used in active campaigns, and it is not listed in CISA KEV.
Single-use authorization-code enforcement can be bypassed under concurrency in the better-auth OAuth provider (@better-auth/oauth-provider 1.6.0 through 1.6.10, the embedded plugin in better-auth 1.4.8-beta.7 through 1.6.10, and the legacy oidc-provider and mcp plugins). Because the POST /oauth2/token authorization_code grant redeems the code via a non-atomic find-then-delete, two concurrent requests carrying the same code both pass the read step and each mint a fresh access, refresh, and id token for the original user's scope. No public exploit is identified at time of analysis and it is not in CISA KEV, but the vendor rates it CVSS 4.0 7.6 (High) with high confidentiality and integrity impact.
Server-side request forgery in the @better-auth/sso plugin (versions >= 0.1.0 through < 1.6.11, and 1.7.0-beta.x) lets any authenticated Better Auth session register an OIDC provider with attacker-controlled endpoint URLs, which the auth server then fetches during callback and reflects into the user profile - a non-blind SSRF exposing cloud metadata (IMDS 169.254.169.254), internal APIs, and localhost-bound services like Redis. When trustEmailVerified is enabled it escalates to full account takeover via forged emailVerified claims. Carrying a CVSS 9.6 (scope-changed) rating with no public exploit identified at time of analysis, the flaw was reported by Vaadata and fixed in 1.6.11.
Authentication bypass in the joserfc Python JOSE/JWT library (PyPI, versions <= 1.6.7) lets unauthenticated attackers forge valid HS256/HS384/HS512 tokens whenever the application's verification secret resolves to an empty string or None. Because HMACAlgorithm.verify feeds a zero-length key straight into hmac.new(b"", ...) and OctKey.import_key only warned (never rejected) empty material, an attacker who knows no secret can reproduce the exact digest with HMAC(key=b"") and pass hmac.compare_digest. Publicly available exploit code exists (working PoC in the advisory); the flaw is fixed in 1.6.8. This is the cross-language sibling of ruby-jwt CVE-2026-45363. No EPSS score or CISA KEV listing was provided; no public exploit-in-the-wild is claimed.
Arbitrary code execution in Amazon's AWS Advanced JDBC Wrapper (versions 3.3.0 through 4.0.0) arises from the RemoteQueryCachePlugin deserializing cached query results from Redis or Valkey via a raw ObjectInputStream with no class filtering. An actor able to write to the shared cache can poison entries with a crafted serialized Java object, triggering gadget-chain execution on every application server that later reads that cache entry. No public exploit identified at time of analysis; risk is elevated because a single poisoned cache key fans out to all consuming app servers.
Insecure deserialization (CWE-502) in IBM Langflow OSS versions 1.0.0 through 1.10.0 lets any party with access to the backing Redis store inject a malicious serialized object that Langflow deserializes, yielding arbitrary code execution with full application privileges. Successful exploitation exposes all stored secrets, flow data, and the underlying host, effectively a complete compromise of the Langflow instance. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV; a vendor patch is available per IBM advisory node 7278443.
Cleartext credential disclosure in OpenProject's Storages module (versions prior to 17.3.3 and 17.4.1) writes the userless OneDrive/SharePoint OAuth access_token in plaintext to Rails.cache under the deterministic key storage.<id>.httpx_access_token, refreshed by an hourly cron and every userless-OAuth call. Because none of the supported cache backends (file_store, memcache, redis) encrypts at rest, an attacker who can read the cache backend retrieves the Azure-AD application-tier bearer token via an anonymous memcached/Redis get. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Remote code execution in Spring Statemachine 3.2.0-3.2.4 and 4.0.0-4.0.1 allows authenticated attackers to execute arbitrary code inside the application JVM by injecting malicious serialized Java objects into the Kryo-based persistence backends (JPA, MongoDB, Redis, or ZooKeeper). The flaw stems from deserializing persisted state-machine contexts without enforcing a class allowlist, a classic CWE-502 pattern that has historically yielded reliable gadget-chain exploitation in Java applications. No public exploit identified at time of analysis, but the deserialization sink and Kryo gadget ecosystem make weaponization straightforward once an attacker can write to the persistence store.
Account impersonation in Budibase 3.37.2 through 3.38.x allows attackers with a Slack, Discord, or MS Teams account in the same workspace to silently bind their external chat identity to any authenticated Budibase user who clicks a crafted link. Because the `/api/chat-links/:instance/:token/handoff` endpoint performs a permanent state-changing write with no consent UI and no CSRF token, a successful link grants the attacker full impersonation through the AI chat agent, reading data and triggering automations as the victim. No public exploit identified at time of analysis beyond the detailed proof-of-concept in the GHSA advisory authored by the reporter.
Server-side request forgery in Open WebUI versions 0.9.5 and earlier allows authenticated OAuth users to read arbitrary internal HTTP responses by abusing the `_process_picture_url` function in `backend/open_webui/utils/oauth.py`, which validates only the initial URL and then permits aiohttp's default 10-redirect follow chain to reach internal addresses. The decoded response body is stored in the attacker's `profile_image_url` and retrievable via `GET /api/v1/auths/`, yielding cloud metadata credentials and access to localhost-bound services. Publicly available exploit code exists (detailed sentinel-verified PoC supplied by the reporter); no public exploit identified at time of analysis in the form of weaponized tooling, and the CVE is not on the CISA KEV list.
Memory exhaustion in Netty's RedisArrayAggregator handler (io.netty:netty-codec-redis) allows remote unauthenticated attackers to drain the JVM-wide direct-memory pool by repeatedly opening and closing Redis pipeline connections before RESP array aggregates complete. Affects netty-codec-redis 4.1.x through 4.1.134.Final and 4.2.0.Final through 4.2.14.Final; vendor patches are available in 4.1.135.Final and 4.2.15.Final. No public exploit identified at time of analysis, EPSS is low (0.04%), and the issue is not in CISA KEV.
Remote denial of service in Netty's netty-codec-redis module (versions <= 4.1.134.Final and 4.2.0.Final through 4.2.14.Final) allows unauthenticated attackers to exhaust direct memory by sending crafted RESP protocol payloads lacking the required \r\n terminator across multiple concurrent connections. The RedisDecoder buffers digit streams indefinitely while awaiting a line terminator, eventually triggering OutOfDirectMemoryError and preventing legitimate connections from being processed. No public exploit identified at time of analysis, but the vendor advisory GHSA-6ghj-frrj-jjj3 confirms the issue and patched releases are available.
Denial of service in Netty's netty-codec-redis module (versions <= 4.1.134.Final and 4.2.0.Final through 4.2.14.Final) allows remote unauthenticated attackers to exhaust JVM heap memory by sending Redis payloads with unbounded nested array headers. The RedisArrayAggregator allocates a new AggregateState and ArrayList for every nested array header without enforcing a depth limit, so a continuous stream of `*1\r\n` headers triggers an OutOfMemoryError. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Privilege escalation to root in the LiteSpeed User-End cPanel Plugin (versions 2.3 through before 2.4.5) lets attackers abuse the plugin's Redis enable/disable functionality (the redisAble cpanel_jsonapi_func) to gain elevated, potentially root-level, access on the cPanel host. This flaw is confirmed actively exploited (CISA KEV) with in-the-wild activity observed in May 2026, publicly available exploit code exists (including a GitHub PoC), and the vendor scores it CVSS 4.0 10.0. Notably, the parent LiteSpeed WHM Plugin is not affected - only the end-user cPanel plugin.
Stored cross-site scripting in Budibase self-hosted deployments (versions before 3.38.2) allows any authenticated user with Builder role - or any BASIC/POWER user with table WRITE permission - to upload SVG, HTML, or JavaScript files containing active content via the /api/attachments/process and /api/attachments/:tableId/upload endpoints. The files are stored in the configured object store (MinIO/S3) with their executable MIME types and served via signed URLs, so any end user viewing an attachment triggers script execution in their browser session. Publicly available exploit code exists (detailed PoC in the GHSA advisory); no public exploit identified in active campaigns at time of analysis.
Pre-authenticated remote code execution in Algernon web server (≤ 1.17.6) allows attackers who can place a handler.lua file anywhere in a parent directory of the server root to execute arbitrary Lua - including shell commands via run3() and os.execute - in the server process on the next HTTP request. The flaw stems from DirPage walking up to 100 ancestor directories past the configured server root searching for handler.lua, and the permission middleware does not gate this lookup, so an anonymous GET / suffices to trigger execution. Publicly available exploit code exists (the reporter published three working PoC variants and a live verification against 1.17.6).
Insecure deserialization in Significant-Gravitas AutoGPT platform versions 0.6.34 through 0.6.51 lets an attacker who can poison entries in the shared Redis cache achieve arbitrary command execution inside the backend container. The backend's read path invokes pickle.loads on cache bytes with no HMAC, signature, or schema gate, so any attacker-controlled value reaching that key becomes code on retrieval. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; the vendor shipped a fix in autogpt-platform-beta-v0.6.52.
Authentication bypass in the ruby-jwt gem (versions < 3.2.0) allows remote attackers to forge valid HS256/HS384/HS512 tokens when an application supplies an empty string or nil as the verification key. Because OpenSSL::HMAC.digest happily computes a digest under an empty key and JWT::JWA::Hmac coerces nil to '' without validating, any application whose key lookup degrades to '' (common with Redis misses, ORM string defaults, or `ENV['SECRET'] || ''` patterns) will accept attacker-signed tokens. No public exploit identified at time of analysis, but the vendor advisory (GHSA-c32j-vqhx-rx3x) and the v3.2.0 patch confirm the issue and the trivial forgery primitive.
Budibase's REST datasource integration before version 3.38.1 bypasses IP blacklist security controls through HTTP redirect following. Authenticated Builder-level users can exploit this to access cloud metadata services and internal databases by redirecting requests through attacker-controlled servers, potentially stealing AWS/GCP/Azure credentials. This vulnerability class was previously fixed in automation steps but the REST integration was overlooked, creating an inconsistent security posture.
Broken object-level authorization in Open WebUI allows any authenticated low-privilege user to enumerate and terminate background tasks belonging to other users via GET /api/tasks and POST /api/tasks/stop/{task_id}. Attackers can disrupt system-wide chat generation and background processing by continuously canceling active tasks across the multi-user instance. Publicly available exploit code exists. Vendor-released patch in v0.9.0 restricts global task endpoints to admin-only and introduces a scoped /api/tasks/chat/{chat_id}/stop endpoint for legitimate user-owned task termination. CVSS 7.1 (AV:N/AC:L/PR:L/UI:N) reflects network-accessible, low-complexity exploitation requiring only authenticated low-privilege access, with high availability impact and low confidentiality impact from task enumeration.
Server-Side Request Forgery (SSRF) in Open WebUI versions ≤0.8.12 allows authenticated users with OAuth access to force the server to make HTTP requests to arbitrary internal resources and exfiltrate complete response data. Exploitation requires OAuth-enabled deployments with ENABLE_OAUTH_SIGNUP=true or OAUTH_UPDATE_PICTURE_ON_LOGIN=true. An attacker controls the OAuth provider's 'picture' claim URL, triggering server-side HTTP requests to cloud metadata services (AWS IMDS), localhost services (Redis, Elasticsearch), or internal network endpoints. The full response is base64-encoded and stored in the user's profile_image_url field, enabling complete data exfiltration. Fixed in version 0.9.0 per GitHub advisory GHSA-24c9-2m8q-qhmh. EPSS data not available; no CISA KEV listing indicates limited widespread exploitation, though publicly available proof-of-concept exists in the GitHub advisory.
Server-Side Request Forgery in Budibase self-hosted instances allows authenticated Global Builder users to bypass SSRF protections via trivial substring manipulation in plugin URL uploads. The vulnerability exploits a flawed validation check that accepts any URL containing '.tar.gz' anywhere in the string, enabling requests to internal cloud metadata services (AWS IMDS at 169.254.169.254), CouchDB, Redis, and private network ranges when chained with the BLACKLIST_IPS bypass (CVE-2026-45060) or via HTTP redirect chains. CVSS 7.7 (High) with Changed Scope indicates cross-boundary impact from application to infrastructure layer. Vendor-released patch available in version 3.35.10 per GitHub security advisory GHSA-xh5j-727m-w6gg. EPSS data not available; no CISA KEV listing at time of analysis. Publicly available exploit code exists in researcher's GitHub repository with Docker-based proof-of-concept.
Cross-instance cache poisoning in Open WebUI allows administrators on one instance to inject malicious tool server configurations into shared Redis cache, affecting users on other instances. The vulnerability stems from missing Redis key prefixes on tool_servers and terminal_servers cache entries in backend/open_webui/utils/tools.py. When multiple Open WebUI instances share a Redis backend (a documented multi-region/blue-green deployment pattern), an admin on Instance A can configure a malicious tool server that overwrites Instance B's cache, causing Instance B users to send tool call payloads-containing chat content, user identity, and OAuth tokens-to attacker-controlled servers. Exploitation requires privileged access (CVSS PR:H) but crosses instance boundaries (Scope:Changed), enabling data exfiltration and prompt injection delivery. Vendor-released patch: version 0.9.0 addresses the missing prefix issue.
Heap-based buffer overflow in RedisBloom versions before 2.8.20 enables remote code execution via Redis RESTORE command when authenticated attackers supply malicious serialized payloads. The vulnerability stems from improper validation of deserialized data in the probabilistic data structures module. Exploitation requires Redis authentication and RESTORE command privileges (PR:L), with CVSS 7.7 rating reflecting the authentication requirement despite critical impact potential. No public exploit code or CISA KEV listing identified at time of analysis, though vendor has released security-focused patch 2.8.20.
Remote code execution in RedisTimeSeries versions before 1.12.14 allows authenticated attackers with RESTORE command permissions to execute arbitrary code via crafted serialized payloads. The vulnerability stems from improper validation of data processed through Redis RESTORE command, enabling heap buffer overflow exploitation. Attackers with low-level privileges can achieve complete system compromise (CVSS 7.7, CVSS:4.0 High confidentiality/integrity/availability impact) through network-based attacks with high complexity. No public exploit code or active exploitation confirmed at time of analysis.
Remote code execution in Redis server versions up to 8.6.3 allows authenticated attackers with RESTORE command privileges to execute arbitrary code by submitting maliciously crafted serialized payloads. The vulnerability stems from insufficient validation of serialized values in the RESTORE command, enabling heap-based buffer overflow conditions. Redis released version 8.6.3 to patch this flaw alongside four other critical RCE vulnerabilities. EPSS data not available; no CISA KEV listing identified at time of analysis, suggesting targeted rather than widespread exploitation.
Use-after-free in Redis 7.2.0 through 8.6.2 allows authenticated attackers to achieve remote code execution by exploiting error handling in the unblock client flow. When a blocked client is evicted during command re-execution, the server fails to handle the error return from processCommandAndResetClient, triggering memory corruption. Redis has released version 8.6.3 with a security fix. No public exploit code or CISA KEV listing identified at time of analysis, suggesting limited observed exploitation despite the critical RCE impact.
Privilege escalation in OpenC3 COSMOS allows low-privileged authenticated users to bypass API authorization and perform administrative actions by executing crafted Python or Ruby scripts via the Script Runner widget. Attackers can directly access Redis database (exposing secrets and configuration settings) and the MinIO buckets service (containing logs, configs, and plugins) due to unrestricted container-to-container network access in the Docker deployment. Vendor-released patch available in version 7.0.0-rc3 and confirmed in 7.0.0 stable release. EPSS data not available; no CISA KEV listing indicates targeted rather than widespread exploitation. CVSS 9.6 (Critical) with scope change reflects the container escape-like privilege boundary violation.
Remote unauthenticated code execution in MixPHP Framework 2.x through 2.2.17 allows attackers to execute arbitrary PHP code by injecting malicious serialized objects into Redis-backed session or cache storage. The framework's RedisHandler directly deserializes untrusted data from Redis using PHP's unserialize() function without validation. CVSS 9.8 with network vector, low complexity, and no privileges required. EPSS and KEV status not provided; SSVC framework marks this as automatable with total technical impact, indicating high exploitability despite no confirmed active exploitation at time of analysis.
Authorization bypass in RustFS, a Rust-based S3-compatible object-storage server, lets any authenticated low-privilege account (for example a read-only user) reconfigure event-notification targets because the four handlers in rustfs/src/admin/handlers/event.rs only verify authentication and skip the validate_admin_request admin-action check used by every other admin handler. An attacker can overwrite an admin-defined webhook or MQTT target by name to silently redirect bucket events - containing object keys, bucket names, user identities, and request metadata - to an attacker-controlled endpoint, evade audit logging, and coerce an SSRF health probe from the server. Publicly available exploit code exists (live PoC scripts), but EPSS is very low (0.05%, 15th percentile) and CISA SSVC lists exploitation as none, indicating a real but not-yet-exploited weakness.
Stored cross-site scripting in mailcow dockerized versions before 2026-03b enables remote attackers to execute arbitrary JavaScript in admin sessions by injecting malicious code through unauthenticated Autodiscover requests. The payload persists in Redis and triggers when administrators view Autodiscover logs on the admin dashboard. CVSS 9.3 reflects the network attack vector and high cross-scope impact, though exploitation requires admin interaction (UI:P) and no public exploit has been identified at time of analysis.
Distribution container registry versions ≤3.0.x and ≤2.8.x restore read access to explicitly deleted blobs when Redis blob descriptor caching and storage deletion are both enabled. After an administrator deletes a blob from repository A, the deletion briefly succeeds, but when repository B later accesses the same digest, it repopulates the shared Redis descriptor cache. Repository A then regains unauthorized read access to the deleted blob because stale repository-scoped membership metadata was never invalidated from Redis. This authorization bypass defeats repository-local content revocation with concrete confidentiality impact. CVSS 7.5 (HIGH) with network attack vector, low complexity, and no authentication required. EPSS exploitation probability is very low (0.03%, 9th percentile), suggesting limited real-world targeting despite public POC availability. Vendor-released patch confirms the issue and provides a fix in version 3.1.0.
Unauthenticated remote code execution (RCE) at root level in Aperi'Solve <3.2.1 allows attackers to execute arbitrary commands via unsanitized password input in JPEG upload functionality. Attack requires no authentication (PR:N) and low complexity (AC:L), with CVSS 9.3 critical severity. Publicly available exploit code exists via GitHub advisory. Attackers gain full container compromise with potential pivot to PostgreSQL/Redis databases and, in misconfigured deployments with Docker socket mounts, possible host system takeover. EPSS data not provided, but given unauthenticated network-based vector and public disclosure with fix details, exploitation risk is substantial for exposed instances.
Server-Side Request Forgery in pyLoad-ng allows authenticated users with ADD permissions to read local files via file:// protocol, access internal network services, and exfiltrate cloud metadata. The parse_urls API endpoint fetches arbitrary URLs without protocol validation, enabling attackers to read /etc/passwd, configuration files, SQLite databases, and AWS/GCP metadata endpoints at 169.254.169.254. Error-based responses create a file existence oracle. Multi-protocol support (file://, gopher://, dict://) escalates impact beyond standard HTTP SSRF. CVSS 7.7 reflects network attack vector, low complexity, and scope change with high confidentiality impact. No public exploit code identified at time of analysis, though detailed proof-of-concept included in advisory demonstrates exploitation via curl commands against Docker deployments.
Unauthenticated Server-Side Request Forgery (SSRF) in Ech0's /api/website/title endpoint allows remote attackers to access internal network services, cloud metadata endpoints (AWS IMDSv1 at 169.254.169.254), and localhost-bound resources without authentication. The vulnerability accepts arbitrary URLs via the website_url parameter with zero validation, enabling attackers to probe internal infrastructure and exfiltrate partial response data through HTML title tag extraction. CVSS 7.2 reflects the
Unsafe deserialization in Roundcube Webmail's Redis/Memcache session handler allows unauthenticated remote attackers to write arbitrary files by crafting malicious session data. Affected versions include all 1.6.x before 1.6.14 and all 1.5.x before 1.5.14. While the CVSS score of 3.7 is low and attack complexity is high, the integrity impact (arbitrary file write) poses a real risk to instances using Redis or Memcache for session storage.
Server-Side Request Forgery in PraisonAI's passthrough API allows authenticated remote attackers to access internal cloud metadata services and private network resources. The vulnerability affects the praisonai Python package where the passthrough() and apassthrough() functions accept unvalidated caller-controlled api_base parameters that are directly concatenated and passed to httpx requests. With default AUTH_ENABLED=False configuration, this is remotely exploitable to retrieve EC2 IAM credent
Server-Side Request Forgery (SSRF) in FastGPT's Model Context Protocol (MCP) tools endpoints allows authenticated attackers to probe internal networks, access cloud metadata services (e.g., AWS/GCP instance credentials), and interact with backend databases like MongoDB and Redis. Affects FastGPT versions prior to 4.14.9.5. The vulnerability has CVSS 7.7 (High) with scope change indicating potential lateral movement to other system components. EPSS data not available; no confirmed active exploitation (not in CISA KEV). Public exploit code exists via GitHub security advisory GHSA-x9vj-5m4j-9mfv with technical details and proof-of-concept guidance.
Spring AI Redis vector store implementations expose sensitive data through unescaped TAG field filter injection in versions 1.0.0-1.0.4 and 1.1.0-1.1.3. Unauthenticated remote attackers can craft malicious filter expressions that bypass query boundaries in RediSearch TAG blocks, allowing extraction of unauthorized information from the vector database (CVSS 7.5 High, C:H). No public exploit identified at time of analysis, though the vulnerability is straightforward to exploit given its low attack complexity (AC:L).
The Performance Monitor plugin for WordPress contains a Server-Side Request Forgery (SSRF) vulnerability in its REST API endpoint that allows unauthenticated attackers to make arbitrary web requests to internal services using dangerous protocols including Gopher. Versions up to and including 1.0.6 are affected. This vulnerability can be chained with services like Redis to achieve Remote Code Execution, making it a critical security concern despite the 7.2 CVSS score.
AVideo, an open-source video platform, contains a server-side request forgery (SSRF) vulnerability that allows unauthenticated attackers to bypass URL validation using IPv4-mapped IPv6 addresses (::ffff:x.x.x.x format). The vulnerable endpoint plugin/LiveLinks/proxy.php can be exploited to access cloud metadata services (AWS, GCP, Azure), internal networks, and localhost services without authentication. A detailed proof-of-concept is publicly available demonstrating credential theft from AWS instance metadata, making this a critical risk for cloud-hosted installations.
Budibase, a low-code platform distributed as a Docker/Kubernetes application, contains a Server-Side Request Forgery (SSRF) vulnerability in its REST datasource query preview endpoint. Authenticated admin users can force the server to make HTTP requests to arbitrary URLs including cloud metadata services, internal networks, and Kubernetes APIs. A detailed proof-of-concept exists demonstrating theft of GCP OAuth2 tokens with cloud-platform scope, CouchDB credential extraction, and internal service enumeration. The CVSS score of 8.7 reflects high confidentiality and integrity impact with changed scope, requiring high privileges but low attack complexity.
Code injection in OneUptime monitoring via custom JS monitor using vm module. PoC and patch available.
Laravel Reverb WebSocket server versions 1.6.3 and below have an insecure deserialization vulnerability enabling remote code execution on the backend server.
A vulnerability in the health check RPM of Cisco IOS XR Software could allow an unauthenticated, remote attacker to access the Redis instance that is running within the NOSi container. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.