A critical double-free flaw in older Dragonfly DB versions allows attackers to run code on servers without authentication credentials.
Key points
- CVE-2026-104192 affects Dragonfly DB versions prior to 1.40.
- The flaw enables unauthenticated remote code execution via a crafted stream.
- No patched release has been confirmed by the vendor yet.
Dragonfly DB contains a severe vulnerability that lets attackers take control of servers running versions older than 1.40. The issue stems from a memory handling error that can be triggered without any login credentials.
What happened
The National Vulnerability Database lists CVE-2026-104192 as a critical flaw in Dragonfly DB, an in-memory data store. According to the record, the vulnerability exists in all versions prior to 1.40. The issue occurs in the `OpaqueObjLoader::CreateStream` function within the `src/server/rdb_load.cc` file. This component handles stream objects when they are loaded into the database.
The flaw is classified as a double-free error, identified by weakness CWE-415. According to the NVD description, the system incorrectly frees a shared object after rejecting a duplicate consumer entry. Subsequent cleanup routines then attempt to free the same object again. This process corrupts the memory allocator.
In the default configuration, Dragonfly DB ships with authentication disabled. This means an unauthenticated client can send a crafted serialized stream to the RESTORE command. According to the source material, this action triggers the double-free condition. The resulting allocator corruption can lead to denial of service. It may also allow attacker-controlled code execution as the Dragonfly service account.
Why it matters
The fix
- Verify if you are running Dragonfly DB versions earlier than 1.40.
- Restrict network access to Dragonfly DB ports from untrusted sources.
- Enable authentication mechanisms if not already configured.
- Monitor system logs for unexpected restarts or access attempts.
Why it matters
Memory safety flaws like double-free errors allow attackers to manipulate how software manages data. When a program frees memory it still needs, it creates chaos in the system's memory structure. Attackers exploit this chaos to inject and run their own instructions. Default configurations that skip authentication make these systems easy targets for anyone on the network.
Teams usually isolate such services behind firewalls. Check whether your monitoring tools can detect unusual memory usage patterns. Ensure that only authorized applications can connect to the database port. Review your deployment settings to confirm that login requirements are enforced. This reduces the chance that an outsider can trigger the flaw.
What to do and how to stay safe: Dragonfly DB
- Scan your infrastructure to identify all instances of Dragonfly DB running versions below 1.40.
- Implement network segmentation to prevent direct internet exposure of Dragonfly DB services.
- Enable strong authentication for all database connections to mitigate unauthenticated access risks.
- Review firewall rules to ensure only trusted application servers can communicate with the database.
Step-by-step guide: Patch Testing: How to Verify Fixes Without Breaking Your Systems
General security guidance from the Crypt Weekly newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-104192?
The vulnerability has a CVSS score of 9.6, which is rated as critical.
Which versions of Dragonfly DB are affected by this flaw?
All versions of Dragonfly DB prior to version 1.40 are affected.
Is there a patched version available yet?
No, the source fix has not yet been mapped to a published release.
