CVE-2026-78378
Received Received - Intake

Redis Glob Pattern Injection in Ransomlook

Publication date: 2026-08-24

Last updated on: 2026-08-24

Assigner: CIRCL

Description
Ransomlook contains a Redis glob pattern injection vulnerability caused by insufficient neutralization of user-controlled input before it is incorporated into Redis SCAN MATCH patterns. The /api/health/<name> endpoint attempted to resolve the supplied name to a known group or market, but when resolution failed it fell back to using the attacker-controlled value directly in a Redis key pattern. An unauthenticated attacker could therefore supply Redis glob metacharacters such as *, ?, [ or ] to broaden the SCAN operation beyond the intended group. For example, requesting /api/health/* could enumerate health information, mirror slugs, and uptime series belonging to all groups and markets, including entities marked as private. Similar unsafe interpolation was present in /api/crypto/chain/<chain> and in the delete_manual_torrent() function. The latter represents a potentially destructive sink because a crafted infohash containing glob metacharacters could cause the scan to match torrent-health keys belonging to other torrents if attacker-controlled input can reach that function. The patch removes the unsafe fallback from the health endpoint and introduces glob escaping for user-controlled values before they are incorporated into Redis SCAN MATCH expressions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-24
Last Modified
2026-08-24
Generated
2026-08-24
AI Q&A
2026-08-24
EPSS Evaluated
N/A
NVD
CVE-2026-78378
EUVD
EUVD-2026-64856

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Redis glob pattern injection flaw in the Ransomlook application. It occurs when user-controlled input is not properly sanitized before being used in Redis SCAN MATCH patterns. Attackers can exploit this by injecting special characters like *, ?, [ or ] to manipulate the scope of Redis operations, potentially accessing unauthorized data.

Detection Guidance

To detect this vulnerability, inspect network traffic for requests to /api/health/*, /api/crypto/chain/*, or patterns involving Redis glob metacharacters. Check Redis logs for unusual SCAN operations with broad MATCH patterns. Review application logs for failed group resolutions followed by direct value usage in Redis commands.

Impact Analysis

An unauthenticated attacker could exploit this to enumerate sensitive data across all groups and markets, including private entities. For example, accessing /api/health/* might expose health information, mirror slugs, and uptime series beyond intended boundaries. Destructive impacts are also possible if attacker input reaches functions like delete_manual_torrent().

Compliance Impact

This vulnerability could lead to unauthorized data exposure, violating confidentiality requirements in GDPR and HIPAA. It may result in data breaches affecting protected health information or personal data, potentially leading to regulatory penalties, fines, or legal consequences for non-compliance.

Mitigation Strategies

Apply the official patch to remove unsafe fallback in the health endpoint and implement glob escaping for user-controlled values in Redis SCAN MATCH expressions. Temporarily restrict access to vulnerable endpoints if patching is delayed. Monitor Redis logs for suspicious SCAN operations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-78378. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart