CVE-2026-63404

Name of the Vulnerable Software and Affected Versions Faktory versions prior to 1.10.0

Description The embedded Redis bootstrapper contains an insecure temporary file flaw. The system writes startup configuration to a fixed, predictable, and world-writable path /tmp/redis.conf, creating the file only if it does not already exist and failing to validate it during subsequent boots. A local unprivileged user can pre-create this file with malicious Redis directives. While Faktory overrides the unixsocket, dir, and logfile options, other directives such as bind, protected-mode, requirepass, and loadmodule remain attacker-controlled. This allows an attacker to expose the job queue over an unauthenticated network port or use the loadmodule directive to execute arbitrary native code within the root-owned Redis process, resulting in privilege escalation from a local unprivileged user to root.

Recommendations Update to version 1.10.0.