CVE-2026-63404: Faktory Privilege Escalation Vulnerability

CVE-2026-63404 Overview

CVE-2026-63404 is an insecure temporary file vulnerability in Faktory, a language-agnostic background job server. Versions prior to 1.10.0 write the embedded Redis bootstrapper configuration to a fixed, world-writable path at /tmp/redis.conf. A local unprivileged user can pre-create this file with attacker-controlled directives before Faktory starts. Because the official systemd unit runs Faktory and its redis-server child as root, an attacker can supply a loadmodule directive to execute arbitrary native code as root. The flaw is classified as [CWE-377: Insecure Temporary File]. The issue is fixed in Faktory version 1.10.0.

Critical Impact
Local unprivileged users can hijack Redis configuration to expose job queues over the network or execute arbitrary code as root.

Affected Products

Faktory background job server versions prior to 1.10.0
Deployments using the official systemd unit that runs Faktory as root
Systems where the embedded Redis bootstrapper writes to /tmp/redis.conf

Discovery Timeline

2026-08-25 - CVE-2026-63404 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-63404

Vulnerability Analysis

The Faktory embedded Redis bootstrapper writes its startup configuration to /tmp/redis.conf, a fixed and predictable path. The bootstrapper only creates the file if it does not already exist and never validates the file on later boots. Since /tmp is world-writable on standard Linux systems, any local unprivileged user can pre-create /tmp/redis.conf before Faktory starts. Faktory then uses the planted file verbatim, overriding only the unixsocket, dir, and logfile options.

Root Cause

The bootstrapper leaves attacker-controlled directives such as bind, protected-mode, requirepass, and loadmodule untouched in the planted file. This design fails to enforce ownership or integrity checks on the configuration file. The vulnerability maps to [CWE-377: Insecure Temporary File], where a program creates or reuses a temporary file in a location writable by other users without validating its contents.

Attack Vector

A local unprivileged user plants a malicious /tmp/redis.conf before Faktory launches. When the systemd unit starts Faktory as root, the spawned redis-server reads attacker-controlled directives. Two exploitation paths exist: silently exposing the job queue over an unauthenticated network port via bind and protected-mode no, or supplying a loadmodule directive that loads a shared object into the root-owned Redis process for arbitrary code execution as root.

 	"net"
 	"os"
 	"os/exec"
+	"path/filepath"
 	"strings"
 	"sync"
 	"syscall"

Source: GitHub Commit 0fb44c0 — the patch in storage/redis.go adjusts how redis.conf is written to avoid TOCTOU and configuration hijack conditions.

Detection Methods for CVE-2026-63404

Indicators of Compromise

Presence of /tmp/redis.conf created by a non-root user prior to Faktory startup
Unexpected loadmodule directives in the running Redis configuration
Redis listening on non-loopback interfaces with protected-mode no set
Unexpected shared object (.so) files referenced by the Redis process on disk

Detection Strategies

Audit file ownership and modification times on /tmp/redis.conf before each Faktory boot
Compare the running Redis configuration returned by CONFIG GET * against expected defaults
Monitor for redis-server child processes spawned by Faktory that load unexpected native modules
Inspect open network sockets held by the Redis process for exposure beyond 127.0.0.1

Monitoring Recommendations

Enable Linux audit rules for file creation events in /tmp matching redis.conf
Log all systemd service starts of Faktory and capture the effective Redis command line
Alert on Redis processes running as root with non-standard loadmodule arguments
Track process ancestry so any child of Faktory executing unexpected binaries is flagged

How to Mitigate CVE-2026-63404

Immediate Actions Required

Upgrade Faktory to version 1.10.0 or later, where the configuration handling is fixed
Remove any existing /tmp/redis.conf file and verify no unauthorized file is planted before restart
Restrict local shell access on hosts running Faktory to trusted administrative accounts only
Review the current Redis configuration for unauthorized bind, requirepass, or loadmodule directives

Patch Information

The fix is available in Faktory v1.10.0. See the GitHub Release v1.10.0 and the GitHub Security Advisory GHSA-j2vx-rpwf-w77v. The upstream commit 0fb44c0 modifies storage/redis.go to remove the reliance on a predictable, world-writable path.

Workarounds

Run Faktory under a dedicated non-root system account to eliminate the root escalation path
Configure systemd with PrivateTmp=true so Faktory receives a private /tmp namespace
Set restrictive permissions or use a bind-mount to prevent unprivileged writes to /tmp/redis.conf
Pre-create /tmp/redis.conf as a root-owned file with mode 0600 before starting Faktory

bash

# Configuration example: harden the Faktory systemd unit
[Service]
User=faktory
Group=faktory
PrivateTmp=true
ProtectSystem=strict
NoNewPrivileges=true