CVE-2026-25589: RCE in RedisBloom Redis Module
Platform
redis
Component
redis-server
Fixed in
2.8.20
CVE-2026-25589 is a Remote Code Execution (RCE) vulnerability affecting the RedisBloom module for Redis, specifically versions up to 2.8.20. An authenticated attacker can exploit this flaw by crafting a malicious payload through the RESTORE command, potentially leading to complete system compromise. The vulnerability has been fixed in version 2.8.20, and a workaround involving Access Control Lists (ACLs) is available.
Impact and Attack Scenarios
Successful exploitation of CVE-2026-25589 allows an attacker to execute arbitrary code on the Redis server hosting the RedisBloom module. This grants them complete control over the affected system, enabling data theft, modification, or deletion. The attacker could also leverage this access to move laterally within the network, compromising other systems connected to the Redis server. The blast radius extends to any data stored or processed by the Redis instance, including sensitive information like user credentials, session data, and application state. This vulnerability shares similarities with other deserialization vulnerabilities where crafted payloads can bypass security checks and lead to code execution.
Exploitation Context
CVE-2026-25589 is currently not listed on KEV or EPSS, suggesting a low to medium probability of active exploitation. Public Proof-of-Concept (PoC) exploits are not widely available at this time. The vulnerability was published on 2026-05-05, and it remains to be seen if attackers will actively target this flaw. Refer to the official RedisBloom advisory for further details.
Threat Intelligence
Exploit Status
EPSS
0.27% (50% percentile)
CVSS Vector
What do these metrics mean?
- Attack Vector
- Network — remotely exploitable over the internet. No physical or local access required. Widest attack surface.
- Attack Complexity
- Low — no special conditions required. Attacker can exploit reliably without depending on rare configurations or timing.
- Privileges Required
- Low — any valid user account is sufficient. Basic authenticated access required.
- User Interaction
- None — attack is automatic and silent. Victim does nothing: no click, no file open.
- Scope
- Unchanged — impact is limited to the vulnerable component itself.
- Confidentiality
- High — complete confidentiality loss. Attacker can read all data: credentials, keys, personal data.
- Integrity
- High — attacker can write, modify, or delete any data: databases, config files, or code.
- Availability
- High — complete crash or resource exhaustion. Full denial of service.
Affected Software
Weakness Classification (CWE)
Timeline
- Published
- Modified
- EPSS updated
Mitigation and Workarounds
The primary mitigation for CVE-2026-25589 is to upgrade the RedisBloom module to version 2.8.20 or later. If an immediate upgrade is not feasible due to compatibility issues or system downtime constraints, restrict access to the RESTORE command using Redis ACL rules. This limits the ability of attackers to execute malicious payloads. Consider implementing network segmentation to isolate the Redis server from other critical systems, minimizing the potential for lateral movement. Regularly review and audit Redis configuration to ensure best practices are followed. After upgrading, verify the fix by attempting a RESTORE operation with a known malicious payload – it should be rejected.
How to fix
Actualice el módulo RedisBloom a la versión 2.8.20 o superior para mitigar la vulnerabilidad. Restrinja el acceso al comando RESTORE utilizando reglas de ACL para evitar que atacantes no autorizados exploten esta falla.
Frequently asked questions
What is CVE-2026-25589 — RCE in RedisBloom Redis Module?
CVE-2026-25589 is a Remote Code Execution vulnerability in the RedisBloom module for Redis, affecting versions up to 2.8.20. An attacker can exploit it via a crafted RESTORE command, potentially gaining full control of the server.
Am I affected by CVE-2026-25589 in RedisBloom Redis Module?
You are affected if you are using RedisBloom versions 2.8.20 or earlier. Check your RedisBloom version using redis-cli info | grep redisbloom_version to determine your risk level.
How do I fix CVE-2026-25589 in RedisBloom Redis Module?
Upgrade to RedisBloom version 2.8.20 or later. As a temporary workaround, restrict access to the RESTORE command using Redis ACL rules.
Is CVE-2026-25589 being actively exploited?
Currently, there is no widespread evidence of active exploitation, but the vulnerability is considered HIGH severity and should be addressed promptly.
Where can I find the official RedisBloom advisory for CVE-2026-25589?
Refer to the official RedisBloom advisory for detailed information and updates: [https://github.com/RedisBloom/redisbloom/security/advisories/GHSA-9g3x-x752-877r](https://github.com/RedisBloom/redisbloom/security/advisories/GHSA-9g3x-x752-877r)
Is your project affected?
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Try it now — no account
Upload any manifest (composer.lock, package-lock.json, WordPress plugin list…) or paste your component list. You get a vulnerability report instantly. Uploading a file is just the start: with an account you get continuous monitoring, Slack/email alerts, multi-project and white-label reports.
Drag & drop your dependency file
composer.lock, package-lock.json, requirements.txt, Gemfile.lock, pubspec.lock, Dockerfile...