Summary
| Parameter | Value |
|---|---|
| CVE ID | CVE-2026-81934 |
| Alert Source | GitHub Advisory - Critical vulnerability |
| CVE Year | 2026 |
| Publication Date | 2026-08-27 |
| Vendor | Redis |
| Product | Redis (TLS-enabled configuration) |
| CVSS Score | 9.8 (Critical) |
| EPSS Score | No data |
| CISA KEV | No |
| Ransomware | Not confirmed |
Vulnerability Description
Source: NVD / Redis
Redis contains a use-after-free vulnerability in the tlsProcessPendingData() function, which handles the TLS pending-data list. The flaw only applies when Redis is configured with TLS support.
A remote, unauthenticated attacker may use it to execute arbitrary commands with the privileges of the Redis server process. The absence of an authentication requirement is the key point: being able to open a TLS connection to the instance is enough.
Fixes were released in versions 8.2.9, 8.4.6, 8.6.6, 8.8.2 and 8.10.1.
There is an irony worth noting: this affects only installations that enabled TLS — that is, the ones that made the extra effort to protect data in transit. The more mature configuration is the vulnerable one here.
A note on EPSS: the missing score reflects the CVE’s freshness, not a risk assessment.
Required Actions
- Identify which Redis instances have TLS enabled — those are the vulnerable ones. Instances without TLS are not covered by this particular flaw (which does not make them safe; missing TLS is a separate problem).
- Upgrade to a fixed version: 8.2.9, 8.4.6, 8.6.6, 8.8.2 or 8.10.1, matching your branch.
- Verify network exposure. Redis should not be reachable from outside the application tier; if the port is more widely available, restrict it regardless of patching.
- Check which account the Redis process runs as. Code execution happens with its privileges — Redis running as root turns this flaw into full host compromise.
Who Is Affected?
The vulnerability affects Redis installations with TLS support enabled, in versions preceding the fixes listed above.
Redis is a standard part of the application tier — session cache, queue broker and store for ephemeral data. It appears in e-commerce, fintech, online banking systems and practically every microservice architecture. TLS tends to be enabled where a regulator or internal policy requires it — meaning financial-sector organisations and telecom operators.
Sources
Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.
