Security8.10.2
Security fixes in Redis 8.10.2
This release addresses critical security vulnerabilities including ACL permission bypasses in transactions, unauthenticated cluster bus access, and server crashes in TimeSeries, RedisSearch, and Vector Sets. The new cluster-bus-port-protected-mode option allows nodes to require TLS authentication for cluster bus communication.
Update urgency: SECURITY: There are security fixes in the release.
Security fixes
- #15673 Commands queued in a transaction could still access keys whose ACL permissions were revoked before the transaction was executed
- #15722 The cluster bus protocol has no authentication of its own unless
tls-clusteris enabled, so any host able to reach a node's bus port could join the cluster and threaten it. A cluster node now warns at startup when its bus port is left unauthenticated, and the newcluster-bus-port-protected-modeoption (defaultno) makes refusing to run in that state an explicit choice: set it toyesand the node starts only whentls-clusterauthenticates the bus - TimeSeries: Prevented Redis from crashing when adding samples to a compressed Time Series key restored from a malformed RDB payload
- RedisSearch: KNN queries on indexes with very long vector field names could cause the server to crash
- Vector Sets: Deeply nested JSON used in Vector Set queries could cause the server to crash
securityaclclustertimeseriessearchvectors
Source: original entry ↗