Insecure Temporary File Flaw in Faktory Background Job Server

CVE-2026-63404

What is CVE-2026-63404?

Faktory, a language-agnostic background job server, is vulnerable to an insecure temporary file issue in versions prior to 1.10.0. The problem arises from its embedded Redis bootstrapper, which writes its startup configuration to a fixed and world-writable path, allowing local unprivileged users to hijack the Redis configuration. By pre-creating the /tmp/redis.conf file with malicious Redis directives before Faktory starts, attackers can impose changes without any validation. This leads to potential exploitation, enabling attackers to expose sensitive job queue information and, due to the elevated permissions of the Redis process running as root, can escalate privileges to execute arbitrary code. This serious vulnerability has been resolved in version 1.10.0.

References