What Actually Happened

A recently identified flaw in Redis (CVE-2026-23479) allows an authenticated user to execute arbitrary OS commands on the database server due to a use-after-free vulnerability in the blocking-client code. Discovered by an autonomous AI tool, the flaw was present in Redis versions 7.2.0 through 7.2.13 and was patched on May 5, 2026. The vulnerability has a CVSS score of 8.8 under version 3.1 and 7.7 under version 4.0.

The Implementation Reality

For teams operating Redis instances, this vulnerability poses a significant risk, especially if Redis is deployed in a cloud environment. The flaw is particularly concerning because many Redis instances are found running without a password, and the default user possesses sufficient privileges to exploit this vulnerability. The use-after-free occurs in the unblockClientOnKey() function, where a client pointer continues to be used after the client has been freed, allowing attackers to overwrite memory and execute shell commands. The exploit requires an authenticated session and specific commands, such as CONFIG SET and EVAL, which are accessible to the default user in many configurations.

The Redis Docker image exacerbates the issue, as it has partial RELRO, leaving the Global Offset Table (GOT) writable at runtime. This vulnerability introduces a complex attack vector that requires careful attention to memory management and access controls. Given the significant number of Redis deployments, especially in cloud environments, the potential blast radius is considerable.

What to Do About It

• Upgrade Redis to the patched versions: 7.2.14, 7.4.9, 8.2.6, 8.4.3, or 8.6.3 as of May 5, 2026. Ensure minor upgrades are drop-in replacements.
• Limit Redis exposure by ensuring it is not accessible from the public internet. Use TLS to encrypt traffic.
• Tighten Access Control Lists (ACLs) to prevent any single role from having @admin, CONFIG, and @scripting privileges simultaneously.
• If Lua scripting is unnecessary, deny @scripting access to eliminate the first stage of the exploit.
• Rotate shared Redis credentials, especially for instances that combine CONFIG, scripting, and stream access.

Source: The Hacker News

At q52, we specialize in AI-augmented security operations and SIEM implementation. Let us help you operationalize threat detection with LLM enrichment — faster triage, fewer false positives, and security intelligence your team can actually act on. Learn about Noogenesis, our AI-powered SIEM platform and connect with us on LinkedIn.