CVE-2025-59790: Apache Kvrocks Privilege Escalation Flaw

CVE-2025-59790 Overview

CVE-2025-59790 is an Improper Privilege Management vulnerability [CWE-269] affecting Apache Kvrocks, a distributed key-value NoSQL database that uses RocksDB as its storage engine and is compatible with the Redis protocol. The flaw affects versions v2.9.0 through v2.13.0 and allows an authenticated low-privileged user to perform actions beyond their intended permission scope. Apache resolved the issue in version 2.14.0.

Critical Impact
An authenticated attacker with low privileges can bypass privilege boundaries on the Kvrocks server, resulting in limited unauthorized access to confidentiality and integrity of stored data.

Affected Products

Apache Kvrocks v2.9.0
Apache Kvrocks versions between v2.9.0 and v2.13.0
Apache Kvrocks v2.13.0

Discovery Timeline

2025-11-28 - CVE-2025-59790 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-59790

Vulnerability Analysis

Apache Kvrocks implements a permission model similar to the Redis Access Control List (ACL) system, allowing operators to grant users specific command and key access. The vulnerability stems from improper enforcement of these privilege boundaries within the affected versions. An authenticated user with limited privileges can invoke operations or access resources reserved for higher-privileged roles.

The network-accessible attack surface increases the risk in shared or multi-tenant Kvrocks deployments. Because Kvrocks operates as a persistent data store, exploitation can expose or modify records that the caller should not touch. The impact is scoped to limited data confidentiality and integrity effects; availability is not directly impacted.

Refer to the Apache Mailing List Thread and the OpenWall OSS Security Discussion for the vendor's technical description.

Root Cause

The root cause is an Improper Privilege Management weakness [CWE-269] in the Kvrocks command authorization layer. The server fails to consistently validate that the authenticated user's assigned permissions cover the requested operation or key namespace. This missing enforcement check allows privilege boundaries defined by the ACL to be crossed.

Attack Vector

Exploitation requires network access to a Kvrocks instance and valid low-privileged credentials. No user interaction is needed. An attacker connects to the Kvrocks service using the Redis protocol, authenticates as a restricted user, and issues commands that should be denied by the ACL policy but are accepted by the vulnerable server.

No public proof-of-concept exploit is available. As of the latest EPSS scoring, the probability of exploitation in the wild remains low.

See the Apache advisory thread for the technical description of the privilege bypass condition.

Detection Methods for CVE-2025-59790

Indicators of Compromise

Kvrocks server logs showing successful execution of commands by users who lack the corresponding ACL grants.
Unexpected AUTH events followed by access to key namespaces outside the authenticated user's declared scope.
Connections to the Kvrocks TCP port from clients or subnets not previously observed in baseline traffic.

Detection Strategies

Enable verbose command logging on Kvrocks and correlate command execution against each user's ACL entries to detect mismatches.
Inventory Kvrocks deployments and identify instances running versions v2.9.0 through v2.13.0 using service banners or configuration management data.
Alert on modifications to sensitive key prefixes performed by non-administrative user accounts.

Monitoring Recommendations

Forward Kvrocks audit and command logs to a centralized log platform for long-term retention and correlation.
Monitor for anomalous privilege usage patterns, such as a low-privileged account issuing administrative commands.
Track outbound network activity from Kvrocks hosts to identify potential data staging following abuse of the privilege bypass.

How to Mitigate CVE-2025-59790

Immediate Actions Required

Upgrade all Apache Kvrocks instances to version 2.14.0 or later, which contains the vendor fix.
Audit existing Kvrocks user accounts and ACL definitions, removing unused or overly broad credentials.
Restrict network exposure of Kvrocks to trusted application tiers using firewalls, security groups, or service mesh policies.
Rotate credentials for any Kvrocks account that may have been used from untrusted networks during the exposure window.

Patch Information

Apache released the patched version 2.14.0 of Kvrocks, which addresses the Improper Privilege Management flaw. The vendor recommends upgrading directly to 2.14.0 or later. Refer to the Apache Mailing List Thread for the official advisory.

Workarounds

Place Kvrocks behind a network boundary that only permits connections from trusted application hosts until the upgrade is applied.
Reduce the privileges of application service accounts to the minimum required commands and key patterns.
Disable or remove Kvrocks user accounts that are not actively required by production workloads.

bash

# Configuration example
# Verify running Kvrocks version via the Redis-compatible INFO command
redis-cli -h <kvrocks-host> -p <port> -a <password> INFO server | grep kvrocks_version

# After upgrading to 2.14.0, confirm the version
redis-cli -h <kvrocks-host> -p <port> -a <password> INFO server | grep kvrocks_version