{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/memcached/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.1,"id":"CVE-2026-29093"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Memcached"],"_cs_severities":["medium"],"_cs_tags":["network-security","memcached","cve-2026-29093","impact"],"_cs_type":"advisory","_cs_vendors":["Memcached"],"content_html":"\u003cp\u003eMemcached is a high-performance, distributed memory object caching system that, by default, operates without authentication. This architectural design makes it susceptible to abuse if exposed to untrusted networks. An attacker with network reachability to a Memcached instance can issue storage commands - such as \u003ccode\u003eset\u003c/code\u003e, \u003ccode\u003eadd\u003c/code\u003e, \u003ccode\u003ereplace\u003c/code\u003e, \u003ccode\u003eappend\u003c/code\u003e, \u003ccode\u003eprepend\u003c/code\u003e, or \u003ccode\u003ecas\u003c/code\u003e - to inject, overwrite, or poison cached data. This vulnerability, tracked as CVE-2026-29093, enables attackers to manipulate application state, overwrite session tokens to facilitate hijacking, or alter security-sensitive information cached in memory. Because Memcached does not require authentication, there is often no audit trail for these write operations, making detection dependent on network-level monitoring of unauthorized or anomalous client-to-server traffic.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker performs network reconnaissance to identify accessible Memcached instances (typically port 11211).\u003c/li\u003e\n\u003cli\u003eAttacker verifies the Memcached version and accessibility by sending non-destructive commands like \u003ccode\u003estats\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eAttacker discovers existing keys within the cache using commands like \u003ccode\u003eget\u003c/code\u003e or \u003ccode\u003elru_crawler\u003c/code\u003e to identify targets for manipulation (e.g., session prefixes).\u003c/li\u003e\n\u003cli\u003eAttacker constructs a malicious payload containing the manipulated data or forged session token.\u003c/li\u003e\n\u003cli\u003eAttacker executes a store command (\u003ccode\u003eset\u003c/code\u003e, \u003ccode\u003eadd\u003c/code\u003e, \u003ccode\u003ereplace\u003c/code\u003e) from a non-authorized client IP to the target server.\u003c/li\u003e\n\u003cli\u003eThe Memcached server accepts the command as valid, overwriting the legitimate cached data with the attacker's payload.\u003c/li\u003e\n\u003cli\u003eThe target application retrieves the poisoned data from the cache during its normal processing lifecycle.\u003c/li\u003e\n\u003cli\u003eApplication executes using the manipulated data, leading to session hijacking, unauthorized access, or logic bypass.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for the compromise of user sessions, modification of critical application content, and potential privilege escalation. The scope of impact is limited to the data cached within the instance, but this often includes sensitive session identifiers, credentials, and business logic state. Organizations relying on Memcached for session management are at highest risk, as token forgery can grant attackers unauthorized access to active user accounts.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eBlock all unauthorized client access to Memcached listeners at the network layer and enforce strict access control lists.\u003c/li\u003e\n\u003cli\u003eBind Memcached instances to internal, private interfaces rather than public or exposed networks.\u003c/li\u003e\n\u003cli\u003eDisable the use of the UDP protocol for Memcached if it is not explicitly required for operation to prevent amplification or injection vectors.\u003c/li\u003e\n\u003cli\u003eDeploy network-based detection to monitor for 'first-time seen' write operations from unusual client IPs, as documented in the detection logic below.\u003c/li\u003e\n\u003cli\u003eEnsure that cached sensitive values are protected and not captured by network sensors to prevent secondary information exposure.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-01T01:42:43Z","date_published":"2026-08-01T01:42:43Z","id":"https://feed.craftedsignal.io/briefs/2026-08-memcached-unauth-write/","summary":"Unauthorized actors can leverage the lack of native authentication in Memcached to perform data manipulation or session hijacking, as identified in CVE-2026-29093.","title":"Unauthorized Memcached Data Manipulation via CVE-2026-29093","url":"https://feed.craftedsignal.io/briefs/2026-08-memcached-unauth-write/"}],"language":"en","title":"CraftedSignal Threat Feed - Memcached","version":"https://jsonfeed.org/version/1.1"}