CVE-2026-63404 contribsys CVE debrief

Who should care

Defenders who manage Faktory installations, especially in environments where local unprivileged users may exist, should assess exposure and prioritize patching or mitigating this vulnerability.

Why it matters

CVE-2026-63404 is a high-severity vulnerability in Faktory that allows a local unprivileged user to hijack the Redis configuration and escalate to root. Defenders should prioritize patching or mitigating this vulnerability, especially in environments where local unprivileged users may exist, and verify Faktory and Redis configurations to prevent exploitation.

• Potential privilege escalation from local unprivileged user to root
• Possible exposure of the entire job queue over an unauthenticated network port
• Execution of arbitrary native code in the root-owned Redis process
• Verification of Faktory and Redis configurations to prevent exploitation

Technical summary

The embedded Redis bootstrapper in Faktory writes its startup configuration to a fixed, predictable, world-writable path, /tmp/redis.conf. A local unprivileged user can pre-create /tmp/redis.conf with attacker-chosen Redis directives before Faktory starts, and Faktory will use the planted file verbatim. This allows an attacker to silently expose the entire job queue over an unauthenticated network port with no visible error to the administrator and execute arbitrary native code in the root-owned Redis process.

Defensive priority

Defenders should prioritize patching or mitigating this vulnerability, especially in environments where local unprivileged users may exist.

Recommended defensive actions

• Patch Faktory to version 1.10.0 or later
• Verify that local unprivileged users do not have write access to /tmp/redis.conf
• Monitor for suspicious activity related to Faktory and Redis
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD vulnerability detail provide information on the vulnerability, its impact, and the fixed version. The vulnerability is caused by an insecure temporary file flaw in the embedded Redis bootstrapper of Faktory, which writes its startup configuration to a fixed, predictable, world-writable path. This allows a local unprivileged user to pre-create the configuration file with attacker-chosen Redis directives, potentially leading to privilege escalation and exposure of the job queue. Defenders should verify Faktory and

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.