CVE-2026-85220: Denial-of-Service in the Thinkst Canary Redis service
A vulnerability in the Thinkst Canary honeypot Redis service allows an unauthenticated remote attacker to execute a Denial-of-Service attack against the honeypot.
The vulnerability is accessible when the Redis service is enabled only.
The Canary is NOT affected if the Redis service is disabled.
Thinkst has addressed this issue on all supported platforms.
New update files to address this issue are available on all platforms except Docker. For Docker customers, a new Docker image has been published which includes the patch. Customers with automatic updates enabled already have updates in distribution. If automatic updates are disabled, customers are advised to update their Canaries.
Workarounds are available for customers unable to update at this time.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Thinkst Canary (AWS EC2)to a version that resolves this vulnerability.Fixed in 5.3.2 - Upgrade
Upgrade
Thinkst Canary (Docker)to a version that resolves this vulnerability.Fixed in 5.7.2 - Upgrade
Upgrade
Thinkst Canary (GCP)to a version that resolves this vulnerability.Fixed in 5.4.2 - Upgrade
Upgrade
Thinkst Canary (Hardware)to a version that resolves this vulnerability.Fixed in 5.1.2 - Upgrade
Upgrade
Thinkst Canary (Microsoft Azure)to a version that resolves this vulnerability.Fixed in 5.6.4 - Upgrade
Upgrade
Thinkst Canary (Microsoft Hyper-V)to a version that resolves this vulnerability.Fixed in 5.5.2 - Upgrade
Upgrade
Thinkst Canary (Nutanix)to a version that resolves this vulnerability.Fixed in 5.9.2 - Upgrade
Upgrade
Thinkst Canary (OCI)to a version that resolves this vulnerability.Fixed in 5.11.2 - Upgrade
Upgrade
Thinkst Canary (OpenStack)to a version that resolves this vulnerability.Fixed in 5.8.2 - Upgrade
Upgrade
Thinkst Canary (Tailscale)to a version that resolves this vulnerability.Fixed in 5.3.2 - Upgrade
Upgrade
Thinkst Canary (VMware ESXi)to a version that resolves this vulnerability.Fixed in 5.2.2 - Configuration
Disable the Thinkst Canary Redis service, since the vulnerability is accessible only when the Redis service is enabled (Canary is not affected if the Redis service is disabled).
Thinkst Canary Redis service Redis service enabled = disabled
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Only Thinkst Canary deployments with the Redis service enabled are affected. Canaries with the Redis service disabled are not affected.
Does an attacker need credentials or user interaction to cause the denial of service?
No. The issue can be exploited remotely by an unauthenticated attacker, although the attack complexity is rated high.
What should Docker-based deployments do?
Docker customers should use the newly published Docker image that includes the patch, because update files are not available for Docker.
What should organizations do if automatic updates are disabled or patching cannot happen immediately?
Customers with automatic updates disabled should update their Canaries. If an update cannot be applied immediately, use the available workarounds; disabling the Redis service prevents exposure.