Low 3.7Published Sep 21, 2026

CVE-2026-85220Denial-of-Service in the Thinkst Canary Redis service

Updated under an hour ago (2026-10-19 07:10 UTC)

Does this affect you?

It affects Thinkst Applied Research Canary. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Thinkst Applied Research Canary

Exploited in the last 30 days

A vulnerability in the Thinkst Canary honeypot Redis service allows an unauthenticated remote attacker to execute a Denial-of-Service attack against the honeypot. The vulnerability is accessible when the Redis service is enabled only. The Canary is NOT affected if the Redis service is disabled. Thinkst has addressed this issue on all supported platforms. New update files to address this issue are available on all platforms except Docker. For Docker customers, a new Docker image has been published which includes the patch. Customers with automatic updates enabled already have updates in distribution. If automatic updates are disabled, customers are advised to update their Canaries. Workarounds are available for customers unable to update at this time.

CVSS: 3.7 LOW (v3.1, CNA)CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness (CWE): CWE-770
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: ThinkstAppliedResearch
NVD analysis: Deferred
Record last updated: Sep 21, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Thinkst Applied Research Canary thinkst_applied_research:canary (from the name)	5.1.2 not affected; 5.2.2 not affected; 5.3.2 not affected; 5.4.2 not affected; 5.5.2 not affected; 5.6.4 not affected; 5.7.2 not affected; 5.8.2 not affected; and 3 more ranges	CNA record

References

https://canary.tools/security-advisories/tc-2026-01.txt

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.