From 8aa39cf24bce3a89dc5566078c36d67ab6db51be Mon Sep 17 00:00:00 2001 From: Arthur Hanson Date: Fri, 17 Jul 2026 04:59:47 -0700 Subject: [PATCH] Closes #22678: Add security note for Redis broker trust / RQ task deserialization (#22679) --- docs/configuration/required-parameters.md | 3 +++ docs/installation/2-redis.md | 6 ++++++ 2 files changed, 9 insertions(+) diff --git a/docs/configuration/required-parameters.md b/docs/configuration/required-parameters.md index 6411fdea7..e08c78890 100644 --- a/docs/configuration/required-parameters.md +++ b/docs/configuration/required-parameters.md @@ -146,6 +146,9 @@ REDIS = { It is highly recommended to keep the task and cache databases separate. Using the same database number on the same Redis instance for both may result in queued background tasks being lost during cache flushing events. +!!! danger "Redis is a trusted component" + NetBox's background workers deserialize and execute jobs read from the `tasks` Redis database, so any party with write access to it can run arbitrary code on a worker. Redis must be treated as trusted infrastructure, on par with the PostgreSQL database: keep it bound to a private network and require authentication. + ### UNIX Socket Support Redis may alternatively be configured by specifying a complete URL instead of individual components. This approach supports the use of a UNIX socket connection. For example: diff --git a/docs/installation/2-redis.md b/docs/installation/2-redis.md index f412cced1..449de5866 100644 --- a/docs/installation/2-redis.md +++ b/docs/installation/2-redis.md @@ -19,6 +19,12 @@ redis-server -v You may wish to modify the Redis configuration at `/etc/redis.conf` or `/etc/redis/redis.conf`, however in most cases the default configuration is sufficient. +!!! danger "Restrict access to Redis" + NetBox's background workers execute jobs read from Redis, so anyone able to write to the `tasks` database can run + arbitrary code on a worker. Treat Redis as trusted infrastructure: keep it bound to `localhost` (the default) or a + private network, and enable authentication if it is reachable by any other host. See + [Redis configuration](../configuration/required-parameters.md#redis) for details. + ## Verify Service Status Use the `redis-cli` utility to ensure the Redis service is functional: