CVE-2025-27150 Overview
CVE-2025-27150 affects Tuleap, an open source suite for managing software development and collaboration. The vulnerability exists in the tuleap collect-system-data command, which generates diagnostic archives for support purposes. These archives fail to purge the Redis instance connection password before packaging system data. Support teams receiving these archives can therefore access credentials they should not possess. This flaw is classified as an information exposure through sent data [CWE-538]. Enalean fixed the issue in Tuleap Community Edition 16.4.99.1740492866, Tuleap Enterprise Edition 16.4-6, and Tuleap Enterprise Edition 16.3-11.
Critical Impact
Redis instance credentials are leaked to any party receiving diagnostic archives, enabling unauthorized access to the cache backend and potentially sensitive session or application data.
Affected Products
- Tuleap Community Edition versions prior to 16.4.99.1740492866
- Tuleap Enterprise Edition versions prior to 16.4-6
- Tuleap Enterprise Edition versions prior to 16.3-11
Discovery Timeline
- 2025-03-04 - CVE-2025-27150 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-27150
Vulnerability Analysis
The vulnerability resides in the tuleap collect-system-data administrative command. This utility gathers configuration files, logs, and system state into a single archive for troubleshooting. The archive generation routine sanitizes some sensitive values but omits the Redis authentication password from its redaction logic. As a result, the plaintext credential remains embedded in the exported archive.
Administrators commonly forward these archives to support engineers, third-party consultants, or upload them to ticketing systems. Each recipient gains access to a valid Redis password intended for internal service use only. An attacker who obtains one of these archives, whether through a compromised support channel or misdirected email, can authenticate to the Redis backend if network access is available.
Root Cause
The root cause is incomplete sanitization of secrets during diagnostic data collection. The archive generation code does not include the Redis password field in its list of values to strip or mask before writing configuration snapshots to the output bundle.
Attack Vector
Exploitation requires user interaction because an administrator must generate and share the diagnostic archive. Once shared, any recipient can extract the archive and read the Redis password directly from included configuration data. No authentication or elevated privileges are required to parse the archive contents.
No verified proof-of-concept code has been published. See the GitHub Security Advisory GHSA-jc5r-684x-j46q and the upstream commit a6702622 for the technical fix.
Detection Methods for CVE-2025-27150
Indicators of Compromise
- Diagnostic archives produced by tuleap collect-system-data on unpatched versions containing plaintext Redis credentials
- Unexpected authenticated connections to the Redis instance from hosts outside the Tuleap application tier
- Redis AUTH command activity originating from IP addresses not associated with Tuleap workers
Detection Strategies
- Inspect existing collect-system-data archives on administrative hosts for the presence of the Redis password string in configuration exports.
- Audit ticketing systems, shared drives, and email archives for previously distributed diagnostic bundles that may contain the credential.
- Monitor Redis access logs for authentication attempts from unexpected sources following any archive disclosure.
Monitoring Recommendations
- Enable Redis command logging and forward events to a centralized logging platform for review.
- Alert on new client connections to Redis originating from IP ranges outside the Tuleap application subnet.
- Track the creation and distribution of collect-system-data archives with file integrity monitoring on Tuleap servers.
How to Mitigate CVE-2025-27150
Immediate Actions Required
- Upgrade to Tuleap Community Edition 16.4.99.1740492866, Tuleap Enterprise Edition 16.4-6, or Tuleap Enterprise Edition 16.3-11 without delay.
- Rotate the Redis password immediately if any diagnostic archive has been generated and shared externally.
- Locate and securely delete any existing collect-system-data archives stored on file shares, ticket systems, or backup media.
Patch Information
Enalean addressed the issue in commit a6702622a8db969a17522b8fac0774afdb1c916f, which updates the diagnostic archive routine to strip the Redis password before packaging. Details are published in the GitHub Security Advisory GHSA-jc5r-684x-j46q and the Tuleap tracker entry 41870.
Workarounds
- Manually inspect and redact the Redis password from any diagnostic archive before sharing with external parties on unpatched installations.
- Restrict Redis network exposure to loopback or the Tuleap application subnet using firewall rules so leaked credentials cannot be reused remotely.
- Enforce access controls on directories containing generated archives and limit who can execute the tuleap collect-system-data command.
# Configuration example: restrict Redis to localhost and rotate credentials
# /etc/redis/redis.conf
bind 127.0.0.1
requirepass <new-strong-password>
# Apply firewall restriction (example using firewalld)
firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="10.0.0.0/24" port port="6379" protocol="tcp" accept'
firewall-cmd --reload
# Update Tuleap Redis configuration with the rotated password, then restart
systemctl restart tuleap
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
