Skip to content
Fencer Vulns
medium 6.0

CVE-2025-46818 json

Redis: Authenticated users can execute LUA scripts as a different user

published 2025-10-03 13 mo ago modified 2026-10-19 20 d ago also BIT-keydb-2025-46818 , BIT-redis-2025-46818 , BIT-valkey-2025-46818 , EUVD-2025-33201 , GHSA-qrv7-wcrx-q5jp

cvss
6.0
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.7%
EPSS 0.7% chance of exploitation in 30 days, percentile 55%
public exploits
0
none known, plus a Nuclei check

Summary

Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to manipulate different LUA objects and potentially run their own code in the context of another user. The problem exists in all versions of Redis with LUA scripting. This issue is fixed in version 8.2.2. A workaround to mitigate the problem without patching the redis-server executable is to prevent users from executing LUA scripts. This can be done using ACL to block a script by restricting both the EVAL and FUNCTION command families.

Patch / fix

  • bitnami keydb 6.2.20, 7.2.11, 7.4.6, 8.0.4, 8.2.2
  • bitnami redis 6.2.20, 7.2.11, 7.4.6, 8.0.4, 8.2.2
  • bitnami valkey 7.2.11, 8.0.6, 8.1.4
  • redis redis 6.2.20, 7.2.11, 7.4.6, 8.0.4, 8.2.2
  • redislabs redis 6.2.20, 7.2.11, 7.4.6, 8.0.4, 8.2.2
  • lfprojects valkey 7.2.11, 8.0.6, 8.1.4
  • linuxfoundation valkey 7.2.11, 8.0.6, 8.1.4
  • valkey-io valkey 7.2.11, 8.0.6, 8.1.4
  • redict redict 7.3.6
  • redis Debian 12 5:7.0.15-1~deb12u6
  • redis Debian 13 5:8.0.2-3+deb13u1
  • redis Debian 14 5:8.0.4-1
  • redict Debian 14 7.3.6+ds-1
  • valkey Debian 13 8.1.1+dfsg1-3+deb13u1
  • valkey Debian 14 8.1.4+dfsg1-1

debian advisories DEBIAN-CVE-2025-46818

  • valkey Ubuntu 24.04 LTS 7.2.11+dfsg1-0ubuntu0.2
  • valkey Ubuntu 25.10 8.1.4+dfsg1-0ubuntu0.2

ubuntu advisories UBUNTU-CVE-2025-46818

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • valkey RHEL 10.1 8.0.6-2.el10_1
  • valkey RHEL 9 8.0.6-2.el9_7
  • redis RHEL 9 7.2.11-1.module+el9.7.0+23559+d075163a
  • redis RHEL 9 6.2.20-2.el9_7
  • valkey RHEL 10.0 8.0.6-1.el10_0
  • redis RHEL 9 7.2.11-1.module+el9.6.0+23552+a3d3d132
  • redis RHEL 9 6.2.20-1.el9_6
  • redis RHEL 8 6.2.20-1.module+el8.10.0+23551+d4cd15d7

red hat advisories RHSA-2025:21936RHSA-2025:21916RHSA-2025:20955RHSA-2025:20926RHSA-2025:19675RHSA-2025:19345

  • valkey SLES for SAP applications 16.0, SLES 16.0 8.0.6-160000.1.1
  • redis SLES for SAP 15 SP3, SLES 15 SP3-LTSS, SLE High Performance Computing 15 SP3-LTSS +1 more 6.0.14-150200.6.43.1
  • redis SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES 15 SP5-LTSS +7 more 6.2.6-150400.3.40.1
  • redis SLE Module for Server Applications 15 SP6, openSUSE Leap 15.6 7.2.4-150600.3.18.1
  • valkey SLE Module for Server Applications 15 SP7 8.0.6-150700.3.11.1
  • redis7 SLES for SAP 15 SP5, SLES 15 SP5-LTSS, SLE High Performance Computing 15 SP5-LTSS +1 more 7.0.8-150500.3.24.1
  • redis7 SLE Module for Server Applications 15 SP6, openSUSE Leap 15.6 7.0.8-150600.8.19.1
  • valkey SLE Module for Server Applications 15 SP6, openSUSE Leap 15.6 8.0.6-150600.13.17.1

suse advisories SUSE-SU-2026:20022-1SUSE-SU-2025:03507-1SUSE-SU-2025:03506-1SUSE-SU-2025:03505-1SUSE-SU-2025:03502-1SUSE-SU-2025:03501-1

  • valkey openSUSE Leap 16.0 8.0.6-160000.1.1
  • redis openSUSE Leap 16.0 8.2.3-bp160.1.1
  • valkey openSUSE Tumbleweed 8.1.4-1.1
  • redis openSUSE Tumbleweed 8.2.2-1.1

opensuse advisories openSUSE-SU-2026:20003-1openSUSE-SU-2025:20121-1openSUSE-SU-2025:15604-1openSUSE-SU-2025:15600-1

  • valkey AlmaLinux 9 8.0.6-2.el9_7
  • valkey AlmaLinux 10 8.0.6-2.el10_1
  • redis AlmaLinux 9 6.2.20-2.el9_7
  • redis AlmaLinux 9 7.2.11-1.module_el9.6.0+188+92104ce8
  • valkey AlmaLinux 10 8.0.6-1.el10_0
  • redis AlmaLinux 9 6.2.20-1.el9_6
  • redis AlmaLinux 8 6.2.20-1.module_el8.10.0+4056+739731b0

almalinux advisories ALSA-2025:21916ALSA-2025:21936ALSA-2025:20926ALSA-2025:20955ALSA-2025:19675ALSA-2025:19345

  • redis Rocky Linux 9 7.2.11-1.module+el9.7.0+40013+17379f63
  • redis Rocky Linux 8 6.2.20-1.module+el8.10.0+2081+450a296c
  • valkey Rocky Linux 10 8.0.6-2.el10_1
  • valkey Rocky Linux 9 8.0.6-2.el9_7
  • redis Rocky Linux 9 6.2.20-2.el9_7
  • valkey Rocky Linux 10 8.0.6-1.el10_0
  • redis Rocky Linux 9 6.2.20-1.el9_6

rocky linux advisories RLSA-2025:19345RLSA-2025:20955RLSA-2025:19238RLSA-2025:21936RLSA-2025:21916RLSA-2025:20926

  • redis Alpine 3.21 7.2.11-r0
  • redis Alpine 3.22 8.0.4-r0
  • redis Alpine 3.24, Alpine 3.23 8.2.2-r0
  • redict Alpine 3.24, Alpine 3.23, Alpine 3.22 7.3.6-r0
  • valkey Alpine 3.21, Alpine 3.20 7.2.11-r0
  • valkey Alpine 3.24, Alpine 3.23, Alpine 3.22 8.1.4-r0

alpine advisories ALPINE-CVE-2025-46818

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • valkey Azure Linux 3.0 8.0.6-1
  • redis CBL-Mariner 2.0 6.2.20-1

azure linux advisories AZL-68241AZL-68285

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-46818 updated cvss 6.0

Redis: Redis: Authenticated users can execute LUA scripts as a different user

  • Red Hat Enterprise Linux AppStream (v. 8) redis 6.2.20-1.module+el8.10.0+23551+d4cd15d7
    fixed: vendor fix RHSA-2025:19238
  • Red Hat Enterprise Linux AppStream (v. 9) redis 6.2.20-1.el9_6, redis 6.2.20-2.el9_7, valkey 8.0.6-2.el9_7, redis 7.2.11-1.module+el9.6.0+23552+a3d3d132, redis 7.2.11-1.module+el9.7.0+23559+d075163a
    fixed: vendor fix RHSA-2025:19237
  • Red Hat Enterprise Linux AppStream (v. 10) valkey 8.0.6-1.el10_0, valkey 8.0.6-2.el10_1
    fixed: vendor fix RHSA-2025:19675
  • Red Hat Logging Subsystem for Red Hat OpenShift openshift-logging/vector-rhel9, openshift-logging/fluentd-rhel9, openshift-logging/eventrouter-rhel9, openshift-logging/logging-view-plugin-rhel9, openshift-logging/cluster-logging-rhel9-operator, openshift-logging/log-file-metric-exporter-rhel9, +1 more Red Hat AI Inference Server rhaiis/vllm-tpu-rhel9, rhaiis/vllm-cuda-rhel9, rhaiis/vllm-rocm-rhel9, rhaiis/vllm-spyre-rhel9, rhaiis-preview/vllm-cuda-rhel9 Red Hat Ansible Automation Platform 2 automation-controller, ansible-automation-platform/ee-minimal-rhel8, ansible-automation-platform/ee-minimal-rhel9, ansible-automation-platform-24/de-minimal-rhel8, ansible-automation-platform-24/de-minimal-rhel9, ansible-automation-platform-24/ee-minimal-rhel8, +27 more Red Hat Connectivity Link 1 rhcl-1/limitador-rhel9 Red Hat Developer Hub 1 rhdh/rhdh-hub-rhel9 Red Hat Discovery 1 discovery/discovery-server-rhel9
    +7 more products
    Red Hat Discovery 2 discovery/discovery-server-rhel9 Red Hat Enterprise Linux AI (RHEL AI) rhelai1/bootc-amd-rhel9, rhelai1/bootc-azure-amd-rhel9, rhelai1/instructlab-amd-rhel9 Red Hat OpenShift AI (RHOAI) rhoai/odh-feature-server-rhel9, rhoai/odh-llama-stack-core-rhel9 Red Hat OpenShift Container Platform 4 openshift4/ose-ironic-rhel9, openshift4/ose-ironic-agent-rhel9 Red Hat OpenStack Platform 13 (Queens) rhosp13/openstack-zaqar, rhosp13/openstack-ec2-api, rhosp13/openstack-horizon, rhosp13/openstack-tempest, rhosp13/openstack-aodh-api, rhosp13/openstack-collectd, +83 more Red Hat Quay 3 quay/quay-rhel8 Red Hat Satellite 6 satellite/iop-advisor-engine-rhel9
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-26-083-03 updated cvss 6.0

"Schneider Electric Plant iT/Brewmaxx"

  • Schneider Electric Plant iT/Brewmaxx >= 9.60
    affected: vendor fix proleit.com
  • Schneider Electric Plant iT/Brewmaxx ProLeiT
    fixed

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
13 mo ago

Exploit prediction

0.74% chance of exploitation in the next 30 days, higher than 55% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • Nuclei template Redis Lua Sandbox < 8.2.2 - Cross-User Escape nuclei detection template

CVSS scores

assigned by version score vector
CNA 3.1 6.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N
NVD 3.1 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
OSV 3.1 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
bitnami keydb
<6.2.20
>=7.0.0, <7.2.11
>=7.3.0, <7.4.6
>=8.0.0, <8.0.4
>=8.1.0, <8.2.2
6.2.20
7.2.11
7.4.6
8.0.4
8.2.2
bitnami redis
<6.2.20
>=7.0.0, <7.2.11
>=7.3.0, <7.4.6
>=8.0.0, <8.0.4
>=8.1.0, <8.2.2
6.2.20
7.2.11
7.4.6
8.0.4
8.2.2
bitnami valkey
<7.2.11
>=8.0.0, <8.0.6
>=8.1.0, <8.1.4
7.2.11
8.0.6
8.1.4

Affected products

  • redis redis

Classification

Weakness
  • CWE-94 Improper Control of Generation of Code
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

The maintainers of redis/redis published their own advisory on GitHub. Reviewed sources take precedence over it.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.