CVE-2026-78378
Redis Glob Pattern Injection Allows Unauthorized Enumeration of Private Ransomlook Data
Description
Ransomlook contains a Redis glob pattern injection vulnerability caused by insufficient neutralization of user-controlled input before it is incorporated into Redis SCAN MATCH patterns. The /api/health/<name> endpoint attempted to resolve the supplied name to a known group or market, but when resolution failed it fell back to using the attacker-controlled value directly in a Redis key pattern. An unauthenticated attacker could therefore supply Redis glob metacharacters such as *, ?, [ or ] to broaden the SCAN operation beyond the intended group. For example, requesting /api/health/* could enumerate health information, mirror slugs, and uptime series belonging to all groups and markets, including entities marked as private. Similar unsafe interpolation was present in /api/crypto/chain/<chain> and in the delete_manual_torrent() function. The latter represents a potentially destructive sink because a crafted infohash containing glob metacharacters could cause the scan to match torrent-health keys belonging to other torrents if attacker-controlled input can reach that function. The patch removes the unsafe fallback from the health endpoint and introduces glob escaping for user-controlled values before they are incorporated into Redis SCAN MATCH expressions.
INFO
Published Date :
Aug. 24, 2026, 2:17 p.m.
Last Modified :
Oct. 14, 2026, 1:10 p.m.
Remotely Exploit :
Yes !
Source :
5a6e4751-2f3f-4070-9419-94fb35b644e8
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 4.0 | MEDIUM | 5a6e4751-2f3f-4070-9419-94fb35b644e8 | ||||
| CVSS 4.0 | MEDIUM | 5a6e4751-2f3f-4070-9419-94fb35b644e8 |
Solution
- Escape user-supplied input for Redis SCAN MATCH.
- Remove unsafe fallbacks in endpoints.
- Apply vendor patches when available.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-78378.
| URL | Resource |
|---|---|
| https://github.com/RansomLook/RansomLook/commit/1f14c01b6fdf8d534edfb2790cf76f5bac6e73f8. |
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-78378 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-78378
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-78378 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-78378 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Oct. 14, 2026
Action Type Old Value New Value Added Translation Title: ransomlook, Description: Ransomlook contiene una vulnerabilidad de inyección de patrón glob de Redis causada por la neutralización insuficiente de la entrada controlada por el usuario antes de que se incorpore en los patrones Redis SCAN MATCH. El endpoint /api/health/<name> intentó resolver el nombre proporcionado a un grupo o mercado conocido, pero cuyo la resolución falló, recurrió a usar el valor controlado por el atacante directamente en un patrón de clave de Redis. Un atacante no autenticado podría, por lo tanto, proporcionar metacaracteres glob de Redis como '*', '?', '[' o ']' para ampliar la operación SCAN más allá del grupo previsto. Por ejemplo, solicitar /api/health/* podría enumerar información de salud, 'mirror slugs' y series de tiempo de actividad pertenecientes a todos los grupos y mercados, incluidas las entidades marcadas como privadas. Una interpolación insegura similar estaba presente en /api/crypto/chain/<chain> y en la función delete_manual_torrent(). Esta última representa un 'sink' potencialmente destructivo porque un 'infohash' manipulado que contenga metacaracteres glob podría hacer que el escaneo coincida con claves de salud de torrents pertenecientes a otros torrents si la entrada controlada por el atacante puede llegar a esa función. El parche elimina el 'fallback' inseguro del endpoint de salud e introduce el escape de glob para los valores controlados por el usuario antes de que se incorporen en las expresiones Redis SCAN MATCH. -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Aug. 24, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2026-78378', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'yes'}, {'technicalImpact': 'partial'}], 'version': '2.0.3', 'timestamp': '2026-08-24T15:20:38.814691Z'} -
New CVE Received by 5a6e4751-2f3f-4070-9419-94fb35b644e8
Aug. 24, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://github.com/RansomLook/RansomLook', 'vendor': 'ransomlook', 'product': 'ransomlook', 'versions': [{'status': 'affected', 'version': '0', 'versionType': 'semver', 'lessThanOrEqual': '2.0.0'}], 'defaultStatus': 'unaffected'}] Added Description Ransomlook contains a Redis glob pattern injection vulnerability caused by insufficient neutralization of user-controlled input before it is incorporated into Redis SCAN MATCH patterns. The /api/health/<name> endpoint attempted to resolve the supplied name to a known group or market, but when resolution failed it fell back to using the attacker-controlled value directly in a Redis key pattern. An unauthenticated attacker could therefore supply Redis glob metacharacters such as *, ?, [ or ] to broaden the SCAN operation beyond the intended group. For example, requesting /api/health/* could enumerate health information, mirror slugs, and uptime series belonging to all groups and markets, including entities marked as private. Similar unsafe interpolation was present in /api/crypto/chain/<chain> and in the delete_manual_torrent() function. The latter represents a potentially destructive sink because a crafted infohash containing glob metacharacters could cause the scan to match torrent-health keys belonging to other torrents if attacker-controlled input can reach that function. The patch removes the unsafe fallback from the health endpoint and introduces glob escaping for user-controlled values before they are incorporated into Redis SCAN MATCH expressions. Added CVSS V4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Added CWE CWE-200 Added Reference https://github.com/RansomLook/RansomLook/commit/1f14c01b6fdf8d534edfb2790cf76f5bac6e73f8.