CVE-2026-23524: Laravel Reverb RCE Vulnerability

CVE-2026-23524 Overview

CVE-2026-23524 is an insecure deserialization vulnerability in Laravel Reverb, the real-time WebSocket communication backend for Laravel applications. Reverb versions 1.6.3 and below pass data received from a Redis channel directly into PHP's unserialize() function without restricting which classes can be instantiated. An attacker who can write to the Redis channel can trigger Remote Code Execution (RCE) on the Reverb server through a PHP object injection chain. The vulnerability only affects deployments where horizontal scaling is enabled via REVERB_SCALING_ENABLED=true. The issue is fixed in Laravel Reverb version 1.7.0.

Critical Impact
Unauthenticated attackers with Redis access can execute arbitrary PHP code on Reverb nodes, leading to full server compromise of Laravel application backends.

Affected Products

Laravel Reverb versions 1.6.3 and below
Laravel applications with REVERB_SCALING_ENABLED=true
Deployments using Redis as the Reverb scaling backend

Discovery Timeline

2026-01-21 - CVE-2026-23524 published to NVD
2026-03-06 - Last updated in NVD database

Technical Details for CVE-2026-23524

Vulnerability Analysis

Laravel Reverb uses Redis pub/sub channels to coordinate WebSocket events across multiple Reverb nodes when horizontal scaling is enabled. The vulnerable code path consumes messages from the Redis channel and feeds the raw payload into PHP's unserialize() function. Because unserialize() is invoked without an allowed_classes option, any serialized PHP object can be instantiated on the receiving node.

PHP object injection via unserialize() is a well-documented attack class [CWE-502]. An attacker who controls the serialized payload can chain magic methods such as __destruct, __wakeup, or __toString against classes loaded in the Laravel application to achieve arbitrary code execution. Laravel and its common dependencies expose multiple gadget chains suitable for RCE.

Root Cause

The root cause is unsafe deserialization of attacker-controllable data. Reverb implicitly trusts the Redis channel as a private transport, but it does not validate, sign, or restrict the contents of messages prior to calling unserialize(). This trust assumption breaks whenever Redis is reachable to untrusted parties.

Attack Vector

The attack vector is amplified by common Redis deployment patterns. Redis often runs without authentication on internal networks, and instances are frequently exposed to the public internet through misconfiguration. An attacker who can PUBLISH to the Reverb Redis channel sends a crafted serialized PHP payload. The Reverb node consuming the channel deserializes the payload and triggers the gadget chain, resulting in code execution under the Reverb process account.

No authentication, user interaction, or prior foothold on the Laravel application server is required when Redis is exposed. The vulnerability does not affect single-node Reverb deployments where REVERB_SCALING_ENABLED=false.

Detection Methods for CVE-2026-23524

Indicators of Compromise

Unexpected PUBLISH commands to the Reverb Redis channel from unknown source IP addresses.
Child processes spawned by the Reverb worker process such as sh, bash, php -r, or outbound network utilities.
Serialized PHP payloads in Redis traffic containing class markers like O: followed by Laravel framework class names.
New or modified files in the Laravel application directory not associated with a deployment event.

Detection Strategies

Inventory Laravel Reverb installations and identify any node running version 1.6.3 or earlier with REVERB_SCALING_ENABLED=true.
Inspect Redis MONITOR output or slowlog for PUBLISH events targeting Reverb channels from non-application hosts.
Apply process-behavior analytics on Reverb hosts to flag PHP processes spawning shells or downloading payloads.
Review web and reverse-proxy logs alongside Redis network telemetry to correlate suspicious WebSocket-adjacent activity.

Monitoring Recommendations

Enable Redis AUTH and audit logs, and alert on authentication failures or connections from unexpected subnets.
Forward Reverb application logs and host process telemetry to a centralized analytics platform for longitudinal review.
Monitor egress traffic from Reverb hosts for connections to unfamiliar domains following Redis channel activity.

How to Mitigate CVE-2026-23524

Immediate Actions Required

Upgrade Laravel Reverb to version 1.7.0 or later on all nodes.
If immediate upgrade is not possible, set REVERB_SCALING_ENABLED=false on single-node deployments to bypass the vulnerable code path.
Require a strong password on Redis via requirepass and rotate any credentials that may have been exposed.
Restrict Redis network exposure to the loopback interface or a private network segment using firewall rules.

Patch Information

The vendor fix is included in Laravel Reverb v1.7.0. See the GitHub Security Advisory GHSA-m27r-m6rx-mhm4, the remediation commit 9ec26f8, and the Laravel Reverb v1.7.0 release notes.

Workarounds

Configure Redis with a strong password and bind it to private interfaces only.
Place Redis behind host-based firewall rules that permit only Reverb application hosts.
Disable horizontal scaling by setting REVERB_SCALING_ENABLED=false if a single Reverb node meets capacity requirements.
Review the Laravel Reverb Scaling Documentation to validate deployment topology.

bash

# Configuration example: disable Reverb scaling and harden Redis
# In your Laravel .env file
REVERB_SCALING_ENABLED=false

# In redis.conf
requirepass <strong-random-password>
bind 127.0.0.1 ::1
protected-mode yes