[CRITICAL] Valkey (Redis) exposed on mesh network without authentication #13

New issue

Open

opened 2026-05-05 15:43:31 -05:00 by pjennings · 0 comments

pjennings commented

2026-05-05 15:43:31 -05:00

Owner

Labels: area:security, area:containers, priority:critical, type:bug

Description

The Valkey container on db1 binds to 10.255.0.11:1025 without any authentication configured. There is no requirepass directive or ACL configuration.

File: hosts/db1.nix lines 173-186

Impact

CRITICAL — Any host on the mesh network (10.255.0.0/24) can connect to Valkey and:

Read cached session data from Authentik (SSO sessions)
Modify cached data to inject malicious content
Flush the database causing service outages
Use Valkey as a pivot point for further attacks

Services depending on this Valkey instance: Authentik, Pelican Panel, Paperless-ngx.

Recommended Fix

Add requirepass with a strong password to Valkey configuration
Configure per-database ACLs for each service (Authentik uses DB 3, Paperless uses DB 1, Pelican uses DB 2)
Bind Valkey to localhost and use Unix sockets for local containers, or restrict firewall to only known client IPs

**Labels:** `area:security`, `area:containers`, `priority:critical`, `type:bug` ## Description The Valkey container on db1 binds to `10.255.0.11:1025` without any authentication configured. There is no `requirepass` directive or ACL configuration. **File:** `hosts/db1.nix` lines 173-186 ## Impact **CRITICAL** — Any host on the mesh network (10.255.0.0/24) can connect to Valkey and: - Read cached session data from Authentik (SSO sessions) - Modify cached data to inject malicious content - Flush the database causing service outages - Use Valkey as a pivot point for further attacks Services depending on this Valkey instance: Authentik, Pelican Panel, Paperless-ngx. ## Recommended Fix 1. Add `requirepass` with a strong password to Valkey configuration 2. Configure per-database ACLs for each service (Authentik uses DB 3, Paperless uses DB 1, Pelican uses DB 2) 3. Bind Valkey to localhost and use Unix sockets for local containers, or restrict firewall to only known client IPs