Thinkst Canary Fixes Redis DoS Flaw in CVE-2026-85220

In Short

• Thinkst Applied Research disclosed CVE-2026-85220 on September 21, 2026.
• The bug lets an unauthenticated attacker remotely cause a denial of service in a Thinkst Canary honeypot when its Redis service is enabled.
• Thinkst says it has fixed the issue across supported platforms, including a patched Docker image.

What Happened

CVE-2026-85220 affects the Redis service in Thinkst Canary, a honeypot device used to detect intruders by acting like a decoy system. Thinkst said an attacker does not need to log in to trigger the issue, which means it can be exploited “unauthenticated.”

The impact is a denial of service, which means the honeypot can be knocked offline or made unstable, reducing its ability to alert defenders. The issue is only reachable when the Redis service is enabled. Redis is an in-memory database often used as a fast cache, Thinkst uses it here as a service component.

The weakness maps to CWE-770, “allocation of resources without limits or throttling.” In simple terms, the service can be pushed to consume too many resources because there are not enough safeguards to slow requests down.

Thinkst rated the vulnerability as low severity, with a CVSS 3.1 score of 3.7. The advisory credits Teddy Thobane (rootkiTed) for finding the issue.

Why It Matters

Honeypots are security tools, but they still run real services and can become targets themselves. A DoS against a Canary might not expose data, but it can blind a detection setup at the exact time defenders want visibility.

For teams in Africa running small security operations, this is also a reliability issue. If a honeypot is hosted in a branch office or remote site, recovery might require hands-on support.

Thinkst says updates are already distributing for customers with automatic updates enabled. If updates are off, customers should update their Canaries. If patching is not possible immediately, the simplest workaround is to disable the Redis service, because Thinkst says the Canary is not affected when Redis is disabled.