CVE-2026-63404: CWE-377: Insecure Temporary File in contribsys faktory

Faktory, a background job server, in versions before 1.10.0, uses a fixed, predictable, world-writable temporary file (/tmp/redis.conf) for Redis configuration during startup. It only creates this file if it does not exist and does not validate it on subsequent boots. Because /tmp is world-writable, a local unprivileged user can pre-create this file with attacker-controlled Redis directives. Faktory overrides only a few Redis options, leaving critical directives like bind, protected-mode, requirepass, and loadmodule under attacker control. This allows silent exposure of the job queue over an unauthenticated network port and enables escalation from local unprivileged user to root by executing arbitrary native code in the root-owned Redis process. The vulnerability is resolved in Faktory version 1.10.0.

A local unprivileged attacker can hijack the Redis configuration by planting a malicious /tmp/redis.conf file, leading to exposure of the job queue over an unauthenticated network port without alerting administrators. Additionally, the attacker can escalate privileges to root by exploiting the loadmodule directive to execute arbitrary code in the root-owned Redis process. This compromises system confidentiality, integrity, and availability.

This vulnerability is fixed in Faktory version 1.10.0. Users should upgrade to version 1.10.0 or later to remediate this issue. No other mitigation guidance is provided or required according to the available data.