Executive brief
Apache Kvrocks, a distributed database compatible with Redis, contains a security flaw in how it manages user permissions. An attacker with low-level access could bypass security restrictions to gain full control over the database, potentially leading to the theft of sensitive data or a complete service shutdown. Organizations using affected versions should upgrade to version 2.16.0 immediately to secure their data environments.
Technical details
A vulnerability classified as CWE-280 (Improper Handling of Insufficient Permissions or Privileges) exists in Apache Kvrocks versions 2.8.0 through 2.15.0. The flaw allows an authenticated user with low privileges to bypass intended access controls due to improper validation of permissions. Exploitation requires network connectivity and minimal user interaction, potentially resulting in a full compromise of the database's confidentiality, integrity, and availability (VC:H/VI:H/VA:H). The issue is resolved in Apache Kvrocks version 2.16.0.
Affected products
- Apache Kvrocks 2.8.0 through 2.15.0
Timeline
- 2026-06-25: disclosed
- 2026-06-25: advisory