CVE-2026-78378

Ransomlook contains a Redis glob pattern injection vulnerability caused by insufficient neutralization of user-controlled input before it is incorporated into Redis SCAN MATCH patterns. The /api/health/<name> endpoint attempted to resolve the supplied name to a known group or market, but when resolution failed it fell back to using the attacker-controlled value directly in a Redis key pattern. An unauthenticated attacker could therefore supply Redis glob metacharacters such as *, ?, [ or ] to broaden the SCAN operation beyond the intended group. For example, requesting /api/health/* could enumerate health information, mirror slugs, and uptime series belonging to all groups and markets, including entities marked as private. Similar unsafe interpolation was present in /api/crypto/chain/<chain> and in the delete_manual_torrent() function. The latter represents a potentially destructive sink because a crafted infohash containing glob metacharacters could cause the scan to match torrent-health keys belonging to other torrents if attacker-controlled input can reach that function. The patch removes the unsafe fallback from the health endpoint and introduces glob escaping for user-controlled values before they are incorporated into Redis SCAN MATCH expressions.

• CWE-200

• https://github.com/RansomLook/RansomLook/commit/1f14c01b6fdf8d534edfb2790cf76f5bac6e73f8.

Published

Aug 24, 2026

Last Modified

Oct 14, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-78371The File Uploads Addon for WooCommerce WordPress plugin befo…5.9
• CVE-2026-78372RansomLook does not consistently enforce authorization chec…9.2
• CVE-2026-78374Joomla Extension - joomlart.com - Open mail relay via contac…6.9
• CVE-2026-78375Joomla Extension - joomshaper.com - Authenticated Privileged…8.6
• CVE-2026-78376A flaw was found in WebKitGTK. Processing malicious web cont…8.8
• CVE-2026-78377URL redirection to untrusted site ('open redirect') vulnerab…6.1
• CVE-2026-78379Improper neutralization of input used for LLM prompting in t…8.1
• CVE-2026-7838UltraVNC viewer through 1.8.2.2 contains an integer overflow…8.8
• CVE-2026-78380RansomLook fails to enforce the privacy status of ransomware…8.7
• CVE-2026-78381RansomLook contains a path traversal vulnerability in the ha…8.2
• CVE-2026-78383Allocation of resources without limits or throttling vulnera…7.5
• CVE-2026-78384CompressionUtils.inflate() decompressed attacker-controlled …7.5