Redis Glob Pattern Injection Vulnerability in Ransomlook

CVE-2026-78378

What is CVE-2026-78378?

Ransomlook contains a vulnerability that allows attackers to inject Redis glob patterns due to a lack of proper sanitization of user inputs. This issue arises when the /api/health/ endpoint resorts to using attacker-supplied values in Redis key patterns if the resolution fails. By exploiting this, unauthenticated attackers can use specific characters like *, ?, [, or ] to manipulate SCAN operations, potentially exposing sensitive health information across all groups, including private entities. Additionally, similar vulnerabilities exist in other API endpoints, increasing the risk of unauthorized access and data leakage. The remediation involves escaping user-controlled inputs before they are processed in Redis SCAN MATCH expressions.

References