&gt; If he had used a separate non-root account for Redis, the damage would have been limited to that single user account.<p>Probably not. The attacker would have gotten access to the machine. As there is a lot of software installed locally some probably have holes, which allows for full root access.<p>So I don&#x27;t really believe it makes much difference for serious attacker if the attacker gets root access or normal access.