Provenance Record

Clear News piece, 724 words (range 400-1200). Overview, fixes, default divergence between patch releases and unstable, explicit unknowns, operator-facing summary. Neutral tone, no AI self-reference, no time-relative language.

Read all 9 gzipped snapshots from disk (source-0..8.html.gz; manifest status 200, no archive fallback, suspicious_patterns null for all). source-0..4 (release pages 8.10.2, 8.8.3, 8.6.7, 8.4.7, 8.2.10): each shows 'sundb released this 17 Sep' (15:06, 15:04, 15:01, 14:58, 14:53), 'Update urgency: SECURITY'. #15673 ('Commands queued in a transaction could still access keys whose ACL permissions were revoked before the transaction was executed') appears in 8.10.2, 8.8.3, 8.6.7 and 8.4.7 and is ABSENT from 8.2.10, exactly as the article states; the article never asserts the ACL fix for 8.2.10. #15722 text (cluster bus 'has no authentication of its own unless tls-cluster is enabled'; startup warning; 'cluster-bus-port-protected-mode option (default no )'; set to yes and 'the node starts only when tls-cluster authenticates the bus') is identical in all five, matches the article quotes. TimeSeries and Vector Sets crash fixes appear in all five; RedisSearch KNN long-field-name fix appears only in 8.10.2, as stated. source-5 (PR 15673): title 'Fix ACL key permissions not being rechecked at EXEC time', merged into redis:unstable Aug 25, 2026; body contains the quoted 'and still read and write those keys after an operator revoked the pattern with `ACL SETUSER u resetkeys ...`' and 'The same commands, issued fresh on the same connection, were correctly refused'; command-permission recheck claim consistent. source-6 (PR 15722): title 'Make an unauthenticated cluster bus port an explicit choice', merged into unstable Sep 15, 2026; 'a boolean defaulting to yes'; breaking-change line 'Non-TLS cluster deployments will not start after upgrading until they add `cluster-bus-port-protected-mode no`'; 'A standalone instance is unaffected' - all verified. source-7 (redis.conf @ 8.10.2): comment ends 'The default is "no"' and says an unauthenticated bus 'warns about it at startup'; contains 'a MEET from an unknown host is enough to have it added as a node, with its gossip trusted' and 'Enable it unless the cluster bus port cannot be reached by untrusted hosts, for instance because a firewall blocks it.' source-8 (redis.conf @ unstable): 'a cluster node refuses to start unless its cluster bus port is authenticated, or protection is explicitly waived' and 'The default is "yes"'. Both defaults verified exactly; no wrong security-relevant default. Note: the rendered GitHub page text of the conf files embeds the file in JSON, so the cluster section was verified in the raw HTML payload.

Every version, date (Sep 17 releases, Aug 25 and Sep 15 merges), PR number and option default traces to a snapshot. No CVE/GHSA/CVSS appears in any source and none is invented by the article; it explicitly states that no CVE identifiers or severity scores are assigned. Severity language is restrained: the article reports the sources' own wording ('could join the cluster and threaten it', 'potentially threaten') and does not use 'remotely exploitable' or claim in-the-wild exploitation. Minor imprecision: 'a second item, #15722' is true for four releases but it is the first item in 8.2.10 (which lacks #15673); immaterial. The '8.10.2 notes ... All five releases carry' framing is accurate. The Redis conf's own phrase 'Enable it unless the cluster bus port cannot be reached by untrusted hosts' is logically awkward in the source; the article reproduces it as the project's wording and does not build a claim on it.

Accurate, carefully hedged and fully traceable to primary sources. The per-branch ACL fix scope, both cluster-bus defaults, dates and PR details all verify; no CVE or severity fabrication. Approved; freshness noted as a minor editorial concern only.