CVE-2025-46818

What it actually does

An authenticated user can submit a specially crafted Lua script that manipulates LUA objects to execute arbitrary code in the security context of a different user, bypassing intended isolation in the Lua scripting subsystem.

Why it matters to the business

Attackers can escalate privileges within Redis deployments to access or modify data belonging to other users, increasing risk of unauthorized data exposure or tampering across widespread Redis and Linux environments.

How an attack unfolds

Attackers authenticate to Redis and submit malicious Lua scripts through EVAL or FUNCTION commands; groups associated with RediShell and the related CVE-2025-49844 campaign have weaponized this technique to run code under another user's context without requiring additional authentication.

How to fix it

Upgrade redis/redis to the fixed commit 9829bdbfd9e7eeb8fb6c79ce36bcc77a681824b1 (version 8.2.2) or apply package updates linux (Debian:12) 6.1.37-1, linux (Debian:13) 6.3.7-1, or Kernel (Linux) 6.1.29. As a workaround, configure ACL rules to block EVAL and FUNCTION command families for untrusted users.

How to confirm the fix worked

Confirm running version matches or exceeds the listed fixed versions, then test that crafted Lua scripts attempting cross-user operations are rejected or isolated.

Typical attack path

1. Obtain valid Redis credentials
2. Craft Lua script targeting cross-user object manipulation
3. Invoke script via EVAL or FUNCTION command family
4. Execute code in target user context
5. Perform unauthorized data access or actions

How to detect it

Review Redis server logs and audit trails for repeated or anomalous EVAL/FUNCTION invocations, especially those referencing cross-user Lua object access; correlate with known RediShell patterns and similar exploitation seen in related Redis RCE campaigns.

• EVAL.*lua.*user context
• FUNCTION LOAD.*malicious script
• unusual cross-user Lua object manipulation

What your security team should do

• Prioritize upgrade to fixed Redis versions across all instances
• Apply ACL restrictions on EVAL and FUNCTION if immediate patching is delayed
• Audit existing Lua script usage and user permissions
• Monitor threat intelligence for RediShell activity targeting this vector