---
title: Valkey Server Spawning Shell Processes
id: 8f7a3b21-9c4e-4d2f-a8b5-6e1f9d3c7a2b
status: experimental
description: Detects Valkey server process spawning shell interpreters, indicating potential command execution via ZDI-26-833 or similar RCE vulnerabilities.
references:
  - https://www.zerodayinitiative.com/advisories/ZDI-26-833/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|endswith:
      - '/valkey-server'
      - '/redis-server'  # For hybrid environments
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/zsh'
      - '/python'
      - '/perl'
  condition: selection
falsepositives:
  - Legitimate administrative scripts run by Valkey administrators (rare)
  - Monitoring agents with specific Valkey integrations
level: high
---
title: Suspicious Valkey Cluster Bus Connection
id: 3e4f5a6b-7c8d-9e0f-1a2b-3c4d5e6f7a8b
status: experimental
description: Detects network connections to Valkey cluster bus port (16379) from non-standard processes, potentially indicating exploitation attempts or lateral movement.
references:
  - https://www.zerodayinitiative.com/advisories/ZDI-26-833/
  - https://attack.mitre.org/techniques/T1021/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.lateral_movement
  - attack.t1021
logsource:
  category: network_connection
  product: linux
detection:
  selection:
    DestinationPort: 16379
    Image|endswith:
      - '/nc'
      - '/ncat'
      - '/netcat'
      - '/socat'
      - '/python'
      - '/perl'
      - '/ruby'
      - '/php'
  filter:
    Image|endswith:
      - '/valkey-server'
      - '/redis-server'
      - '/valkey-cli'
  condition: selection and not filter
falsepositives:
  - Cluster health checks from orchestration systems
  - Custom management scripts
level: medium
---
title: Valkey Configuration Modification for Persistence
id: 1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects modification of Valkey configuration files to enable persistence mechanisms such as SSH keys, cron jobs, or malicious modules.
references:
  - https://attack.mitre.org/techniques/T1543/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.persistence
  - attack.t1543
logsource:
  category: file_event
  product: linux
detection:
  selection:
    TargetFilename|contains:
      - '/valkey.conf'
      - '/redis.conf'
      - '/etc/valkey/'
      - '/etc/redis/'
  condition: selection
falsepositives:
  - Legitimate configuration management (Ansible, Chef, Puppet)
  - System administration activities
level: medium

// Hunt for Valkey process spawning suspicious child processes
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName has_any ("valkey-server", "redis-server")
| where FileName has_any ("sh", "bash", "dash", "python", "perl", "curl", "wget")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, InitiatingProcessCommandLine
| order by TimeGenerated desc

// Hunt for suspicious network connections to Valkey cluster port
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where RemotePort == 16379
| where InitiatingProcessFileName !has_any ("valkey-server", "redis-server", "valkey-cli", "redis-cli")
| project TimeGenerated, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by TimeGenerated desc

// Hunt for Valkey authentication failures and unusual commands (if audit logging enabled)
Syslog
| where TimeGenerated > ago(24h)
| where ProcessName has_any ("valkey", "redis")
| where SyslogMessage has_any ("AUTH", "CLUSTER", "PUBLISH") or SyslogMessage has ("truncation")
| project TimeGenerated, Computer, ProcessName, SyslogMessage
| order by TimeGenerated desc

-- Hunt for Valkey exploitation indicators
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ 'valkey|redis'
   OR CommandLine =~ 'valkey-server|redis-server'
   OR (Name =~ 'sh|bash|dash' AND CommandLine =~ 'valkey|redis')

-- Check for suspicious network connections to cluster bus
SELECT * FROM netstat()
WHERE (Laddr =~ ':16379' OR Raddr =~ ':16379')
  AND Name !~ 'valkey-server|redis-server'

#!/bin/bash
# ZDI-26-833 Valkey Vulnerability - Emergency Mitigation Script
# Run with root privileges

set -e

VALKEY_BIN=$(which valkey-server 2>/dev/null || which redis-server 2>/dev/null || echo "")
VALKEY_CONF="/etc/valkey/valkey.conf"
REDIS_CONF="/etc/redis/redis.conf"
BACKUP_DIR="/var/backups/valkey-mitigation-$(date +%Y%m%d-%H%M%S)"

function log_message() {
    echo "[$(date '+%Y-%m-%d %H:%M:%S')] $1"
}

function check_valkey_version() {
    log_message "Checking Valkey installation..."
    
    if [ -z "$VALKEY_BIN" ]; then
        log_message "Valkey not found in PATH. Checking common locations..."
        if [ -f "/usr/bin/valkey-server" ]; then
            VALKEY_BIN="/usr/bin/valkey-server"
        elif [ -f "/usr/local/bin/valkey-server" ]; then
            VALKEY_BIN="/usr/local/bin/valkey-server"
        else
            log_message "WARNING: Valkey server binary not found. Manual verification required."
            return 1
        fi
    fi
    
    VERSION=$($VALKEY_BIN --version | grep -oP 'v=\K[0-9.]+' | head -1)
    log_message "Detected Valkey version: $VERSION"
    
    # Compare version (assuming fixed version is 7.2.6 or 8.0.1 based on typical disclosure patterns)
    # Update these version checks based on actual vendor advisory
    if [ "$VERSION" == "unknown" ]; then
        log_message "WARNING: Could not determine version. Assume vulnerable."
        return 0
    fi
    
    log_message "Please verify against official advisory if version $VERSION is patched."
    return 0
}

function backup_config() {
    log_message "Creating configuration backup..."
    mkdir -p "$BACKUP_DIR"
    
    if [ -f "$VALKEY_CONF" ]; then
        cp "$VALKEY_CONF" "$BACKUP_DIR/"
        log_message "Backed up $VALKEY_CONF to $BACKUP_DIR/"
    fi
    
    if [ -f "$REDIS_CONF" ]; then
        cp "$REDIS_CONF" "$BACKUP_DIR/"
        log_message "Backed up $REDIS_CONF to $BACKUP_DIR/"
    fi
}

function apply_network_controls() {
    log_message "Applying network-level mitigations..."
    
    # Check if iptables is available
    if command -v iptables >/dev/null 2>&1; then
        # Block external access to cluster bus port (16379) - allow localhost only
        iptables -C INPUT -p tcp --dport 16379 -s 127.0.0.1 -j ACCEPT 2>/dev/null || \
            iptables -A INPUT -p tcp --dport 16379 -s 127.0.0.1 -j ACCEPT
        
        iptables -C INPUT -p tcp --dport 16379 -j DROP 2>/dev/null || \
            iptables -A INPUT -p tcp --dport 16379 -j DROP
        
        log_message "Applied iptables rules: Localhost-only access to port 16379"
        
        # Save rules (distribution specific)
        if command -v netfilter-persistent >/dev/null 2>&1; then
            netfilter-persistent save
        elif command -v service >/dev/null 2>&1; then
            service iptables save 2>/dev/null || true
        fi
    else
        log_message "WARNING: iptables not available. Manual firewall configuration required."
    fi
    
    # If firewalld is present
    if command -v firewall-cmd >/dev/null 2>&1; then
        firewall-cmd --permanent --new-zone=valkey-restricted 2>/dev/null || true
        firewall-cmd --permanent --zone=valkey-restricted --add-port=6379/tcp
        firewall-cmd --permanent --zone=valkey-restricted --add-port=16379/tcp
        firewall-cmd --reload
        log_message "Configured firewalld restricted zone for Valkey"
    fi
}

function harden_config() {
    log_message "Applying configuration hardening..."
    
    local conf_file=""
    if [ -f "$VALKEY_CONF" ]; then
        conf_file="$VALKEY_CONF"
    elif [ -f "$REDIS_CONF" ]; then
        conf_file="$REDIS_CONF"
    else
        log_message "WARNING: No configuration file found. Skipping config hardening."
        return 1
    fi
    
    # Backup before modification
    cp "$conf_file" "${conf_file}.bak-$(date +%s)"
    
    # Disable dangerous commands if not already disabled
    if ! grep -q "^rename-command CONFIG" "$conf_file"; then
        echo "rename-command CONFIG \"\"" >> "$conf_file"
        echo "rename-command MODULE \"\"" >> "$conf_file"
        echo "rename-command DEBUG \"\"" >> "$conf_file"
        echo "rename-command SHUTDOWN \"\"" >> "$conf_file"
        log_message "Disabled dangerous commands in $conf_file"
    fi
    
    # Ensure bind is set to localhost or specific interface only
    if ! grep -q "^bind 127.0.0.1" "$conf_file" && ! grep -q "^bind ::1" "$conf_file"; then
        log_message "WARNING: Valkey may be exposed externally. Review 'bind' directive in $conf_file"
    fi
    
    # Enable protected mode if not already enabled
    if ! grep -q "^protected-mode yes" "$conf_file"; then
        sed -i 's/^protected-mode.*/protected-mode yes/' "$conf_file" || echo "protected-mode yes" >> "$conf_file"
        log_message "Enabled protected-mode"
    fi
    
    log_message "Configuration hardening applied. Restart Valkey service to take effect."
}

function check_integrity() {
    log_message "Checking for suspicious processes..."
    
    # Check if valkey is running as root (bad practice)
    VALKEY_USER=$(ps -eo user,comm | grep -E 'valkey|redis' | grep -v grep | awk '{print $1}' | head -1)
    if [ "$VALKEY_USER" == "root" ]; then
        log_message "CRITICAL: Valkey is running as root! This increases impact of RCE vulnerabilities."
        log_message "Recommendation: Create dedicated valkey user and run service with reduced privileges."
    fi
    
    # Check for unexpected child processes
    VALKEY_PIDS=$(pgrep -f 'valkey-server|redis-server')
    for pid in $VALKEY_PIDS; do
        CHILDREN=$(pgrep -P $pid)
        if [ ! -z "$CHILDREN" ]; then
            log_message "WARNING: Valkey process $pid has child processes: $CHILDREN"
            ps -o pid,ppid,cmd -p $CHILDREN
        fi
    done
}

function main() {
    log_message "Starting ZDI-26-833 mitigation checks..."
    
    check_valkey_version
    backup_config
    apply_network_controls
    harden_config
    check_integrity
    
    log_message "Mitigation script completed."
    log_message "IMPORTANT: This is a temporary mitigation. Apply official patches immediately."
    log_message "Backup location: $BACKUP_DIR"
}

main

2. **Network Segmentation**: If patching cannot be completed immediately, restrict access to the Valkey cluster bus port (16379) using host-based firewalls or cloud security groups. This port should **never** be exposed to the internet. Limit access to specific cluster member IP addresses only.

3. **Authentication Verification**: Ensure that `requirepass` or `aclfile` is configured for the client port (6379). While the vulnerability title suggests unauthenticated exploitation, enforcing authentication provides defense-in-depth.

### Short-Term Actions (Next 7 Days)

4. **Disable Cluster Mode (If Not Required)**: If your deployment does not require Valkey Cluster (multi-master replication), disable cluster mode entirely by ensuring `cluster-enabled no` is set in the configuration file. This eliminates the vulnerable code path.

5. **Privilege Separation**: Verify that Valkey is not running as root. Create a dedicated system user with minimal privileges:
   ```bash
sudo useradd -r -s /bin/false valkey
sudo chown -R valkey:valkey /var/lib/valkey /var/log/valkey

### Long-Term Strategic Controls

7. **Memory Protection**: Deploy Valkey on systems with memory protection mechanisms enabled, including ASLR (Address Space Layout Randomization) and stack canaries. Consider running Valkey within a seccomp-bpf sandbox to restrict system calls.

8. **Runtime Application Self-Protection (RASP)**: Implement RASP solutions or eBPF-based monitoring to detect and block anomalous memory operations in the Valkey process.

9. **Continuous Monitoring**: Deploy the detection rules provided above to your SIEM. Establish baselines for normal Valkey network behavior and alert on deviations, particularly connections to port 16379 from unexpected sources.

10. **Vendor Advisory Monitoring**: Subscribe to Valkey security announcements (GitHub Security Advisories) and the Zero Day Initiative RSS feed for updates on this and future vulnerabilities.

### Verification

After patching, verify the fix by checking the version string and testing cluster bus functionality:
```bash
valkey-server --version
# Confirm version matches patched release from vendor advisory

# Verify cluster bus is not exposed externally
nmap -p 16379 <external-ip>
# Should return "closed" or "filtered"