CVE-2026-78378

Ransomlook contains a Redis glob pattern injection vulnerability caused by insufficient neutralization of user-controlled input before it is incorporated into Redis SCAN MATCH patterns. The /api/health/<name> endpoint attempted to resolve the supplied name to a known group or market, but when resolution failed it fell back to using the attacker-controlled value directly in a Redis key pattern. An unauthenticated attacker could therefore supply Redis glob metacharacters such as *, ?, [ or ] to broaden the SCAN operation beyond the intended group. For example, requesting /api/health/* could enumerate health information, mirror slugs, and uptime series belonging to all groups and markets, including entities marked as private. Similar unsafe interpolation was present in /api/crypto/chain/<chain> and in the delete_manual_torrent() function. The latter represents a potentially destructive sink because a crafted infohash containing glob metacharacters could cause the scan to match torrent-health keys belonging to other torrents if attacker-controlled input can reach that function. The patch removes the unsafe fallback from the health endpoint and introduces glob escaping for user-controlled values before they are incorporated into Redis SCAN MATCH expressions.

• CWE-200

• https://github.com/RansomLook/RansomLook/commit/1f14c01b6fdf8d534edfb2790cf76f5bac6e73f8.

Published

Aug 24, 2026

Last Modified

Aug 24, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-78367A vulnerability was found in RPM's rpmbuild tarball processi…7
• CVE-2026-78369RansomLook contains a missing authentication vulnerability i…8.8
• CVE-2026-7837A time-of-check time-of-use (TOCTOU) condition in the ad_flu…3.7
• CVE-2026-78370RansomLook contains an authorization flaw in its legacy data…9.2
• CVE-2026-78372RansomLook does not consistently enforce authorization chec…9.2
• CVE-2026-78376A flaw was found in WebKitGTK. Processing malicious web cont…8.8
• CVE-2026-7838UltraVNC viewer through 1.8.2.2 contains an integer overflow…8.8
• CVE-2026-78380RansomLook fails to enforce the privacy status of ransomware…8.7
• CVE-2026-78381RansomLook contains a path traversal vulnerability in the ha…8.2
• CVE-2026-78385RansomLook contains insufficient resource validation in the …8.2
• CVE-2026-78386RansomLook exposed sensitive operator-side scraping configur…8.7
• CVE-2026-78387RansomLook contains an authorization weakness in the web-bas…9.4