CVE-2023-41053 Redis SORT_RO may bypass ACL configuration
Attackers can bypass ACL restrictions to read unauthorized keys via the SORT_RO command in Redis, requiring an upgrade to patched versions.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-41053?
CVE-2023-41053 is a low-severity missing authorization vulnerability in redis, published on 6 Sep 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Redis is an in-memory database that persists on disk. Redis does not correctly identify keys accessed by `SORT_RO` and as a result may grant users executing this command access to keys that are not explicitly authorized by the ACL configuration. The problem exists in Redis 7.0 or newer and has been fixed in Redis 7.0.13 and 7.2.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Weakness: CWE-269
Which versions are affected by CVE-2023-41053?
3 open source packages ship an affected version, including redis, keydb and valkey. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
redis Bitnami | From 7.0.0 | 7.0.13, 7.2.1 |
keydb Bitnami | From 7.0.0 | 7.0.13, 7.2.1 |
valkey Bitnami | From 7.0.0 | 7.0.13, 7.2.1 |
Linux distribution packages (2)
redis7 SUSE:Linux Enterprise Module for Server Applications 15 SP5 | All versions | 7.0.8-150500.3.6.1 |
redis7 openSUSE:Leap 15.5 | All versions | 7.0.8-150500.3.6.1 |
Products include Redis Redis.
How do I fix CVE-2023-41053?
Upgrade redis to a fixed version for your release line: 7.0.13 or 7.2.1.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2023-41053 being exploited?
There is no known exploitation of CVE-2023-41053 in the wild and no public exploit code.
Other vulnerabilities in redis
- CVE-2022-0543 Debian-specific Redis Server Lua Sandbox Escape
- CVE-2026-23479 redis-server use-after-free in unblock client flow may allow remote code execution
- CVE-2026-25243 redis-server RESTORE invalid memory access may allow remote code execution
- CVE-2025-62507 Redis: Bug in XACKDEL may lead to stack overflow and potential RCE
- CVE-2025-48367 Redis DoS Vulnerability due to bad connection error handling
Sources
Also known as ALPINE-CVE-2023-41053, BELL-CVE-2023-41053, BIT-keydb-2023-41053, BIT-redis-2023-41053, BIT-valkey-2023-41053, CLEANSTART-2026-NA38099 and 3 more.