CVE-2023-41053

Redis is an in-memory database that persists on disk. Redis does not correctly identify keys accessed by `SORT_RO` and as a result may grant users executing this command access to keys that are not explicitly authorized by the ACL configuration. The problem exists in Redis 7.0 or newer and has been fixed in Redis 7.0.13 and 7.2.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.

• CWE-269

• https://github.com/redis/redis/commit/9e505e6cd842338424e05883521ca1fb7d0f47f6Patch
• https://github.com/redis/redis/security/advisories/GHSA-q4jr-5p56-4xwcVendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OLBPIUUD273UGRN2WAYHPVUAULY36QVL/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UA4MSJ623BH6HP5UHSJD2FOTN3QM5DQS/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YLYNYT52EHR63E7L7SHRTHEPUMAFFDLX/
• https://github.com/redis/redis/commit/9e505e6cd842338424e05883521ca1fb7d0f47f6Patch
• https://github.com/redis/redis/security/advisories/GHSA-q4jr-5p56-4xwcVendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OLBPIUUD273UGRN2WAYHPVUAULY36QVL/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UA4MSJ623BH6HP5UHSJD2FOTN3QM5DQS/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YLYNYT52EHR63E7L7SHRTHEPUMAFFDLX/

Published

Sep 6, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-41048plone.namedfile allows users to handle `File` and `Image` fi…5.4
• CVE-2023-41049@dcl/single-sign-on-client is an open source npm library whi…6.1
• CVE-2023-4105Mattermost fails to delete the attachments when deleting a m…4.3
• CVE-2023-41050AccessControl provides a general security framework for use …7.7
• CVE-2023-41051In a typical Virtual Machine Monitor (VMM) there are several…4.7
• CVE-2023-41052Vyper is a Pythonic Smart Contract Language. In affected ver…5.3
• CVE-2023-41054LibreY is a fork of LibreX, a framework-less and javascript-…9.1
• CVE-2023-41055LibreY is a fork of LibreX, a framework-less and javascript-…7.5
• CVE-2023-41056Redis is an in-memory database that persists on disk. Redis …8.1
• CVE-2023-41057hyper-bump-it is a command line tool for updating the versio…5.5
• CVE-2023-41058Parse Server is an open source backend server. In affected v…7.5
• CVE-2023-4106Mattermost fails to check if the requesting user is a guest …6.5