Conversation

#MastoAdmins

Please set a password for Redis on your instance:

Add REDIS_PASSWORD to your .env.production config and use the same password in your redis configuration, with the requirepass configuration directive.

Without a password you are a single server side request forgery vulnerability away from someone gaining shell access to your instance. SSRF vulnerabilities are not that rare that it never happens.