TI-2026-58679 Aliases CVE-2026-85522 GHSA-cmxq-3354-mw5w

valkey-io valkey Slot Migration cluster_migrateslots.c createSlotImportJob out-of-bounds

MEDIUM 64CWE-119Published 2026-09-04 · Updated 2026-09-04

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: —
Confidentiality · integrity · availability: None · None · Low
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat.

Summary

A vulnerability was detected in valkey-io valkey up to 9.5.4/9.1.0. Affected by this vulnerability is the function createSlotImportJob of the file src/cluster_migrateslots.c of the component Slot Migration. The manipulation of the argument job_name results in out-of-bounds read. The attack can be executed remotely. The exploit is now public and may be used. Upgrading to version 9.0.5 and 9.1.1 addresses this issue. The patch is identified as f4dc3ca09eb650c2fe14060090a41c524eca803f. Upgrading the affected component is advised.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00859 58th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by the CNA

Fix Fixed valkey (valkey-io): 9.0.5, 9.1.1Red Hat: 1 advisory

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
MLflow	valkey	9.0; 9.1.0; 9.5.0; 9.5.1; 9.5.2; 9.5.3; 9.5.4	9.0.5, 9.1.1	Patch available	CNA

valkey VendorMLflow Affected 9.0; 9.1.0; 9.5.0; 9.5.1; 9.5.2; 9.5.3; 9.5.4 Fixed in 9.0.5, 9.1.1 Patch available CNA

CPE names CNA · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:valkey-io:valkey::::::::	—	—	—

cpe:2.3:a:valkey-io:valkey:*:*:*:*:*:*:*:* Versions — — ·—

Remediation

Fix · CNA valkey (valkey-io) Fixed in 9.0.5, 9.1.1

Red Hat 1 advisory

RHSA-2026:61884 Released 2026-09-01 · Red Hat rating Important
Red Hat Hardened Images RPMs bug fix and enhancement update
- Red Hat Hardened Images valkey-9.0.6-0.1.hum1@aarch64, valkey-9.0.6-0.1.hum1@src, valkey-9.0.6-0.1.hum1@x86_64 +10

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Hardened Images	Fixed	RHSA-2026:61884

Not affected: 2 products

Red Hat Enterprise Linux 10
Red Hat Enterprise Linux 9

Timeline

2026-10-02 Threatist record created from CVE-2026-85522
2026-10-03 Alias added: GHSA-cmxq-3354-mw5w
2026-10-20 Fix available: RHSA-2026:61884 · Red Hat
2026-10-20 Fix available: Red Hat Hardened Images · Red Hat
2026-10-20 CVSS score added · Red Hat
2026-10-21 Affected versions changed · Red Hat

References

Exploit 1

https://github.com/valkey-io/valkey/issues/4207

Patch 3

Other 1

https://github.com/valkey-io/valkey/

TI-2026-46366 Server-side request forgery in mlflow KEVCVSS 3.1CRITICAL 9.3
TI-2023-03518 Absolute Path Traversal in mlflow/mlflow CVSS 3.1CRITICAL 10.0
TI-2023-01113 Path Traversal: '\..\filename' in mlflow/mlflow CVSS 3.1CRITICAL 9.8
TI-2025-31759 Redis Lua Use-After-Free may lead to remote code execution CVSS 3.1CRITICAL 10.0
TI-2026-81527 Code execution via scorer deserialization in MLflow servers CVSS 3.1CRITICAL 9.8
TI-2025-14028 Command Injection in mlflow/mlflow CVSS 3.1CRITICAL 10.0

See all 175 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences