CVE-2026-23479Disclosure(redis / redis)

🤖 An autonomous AI tool found a Redis RCE vulnerability that went unnoticed for more than two years. CVE-2026-23479 can let an authenticated user execute OS commands on the server. The flaw was introduced in Redis 7.2.0 and affected every stable branch until patches were released on May 5. 🔧 Details: https://thehackernews.com/2026/06/autonomous-ai-tool-finds-2-year-old-rce.html

Hmm... this technique sounds familiar 👀 https://www.zeroday.cloud/blog/redis-cve-2026-23479-deep-dive https://t.co/g3WoHKUeH7

CVE-2026-23479 in was one of the high severity bugs we found when we won at @wiz_io's ZeroDay Cloud competition. Be on the lookout soon for the technical deep dive on ZDC blog - this was a really interesting bug because of its subtlety. The complex interaction between portions of code far apart from each other in the codebase likely wouldn't have been noticed by humans or traditional SAST tools but can now be found in hours through AI with the right scaffolding Big thanks to the teams at @Redisinc and Wiz for the collaboration https://redis.io/blog/security-advisory-cve202623479-cve202625243-cve-2026-25588-cve202625589-cve-2026-23631/

Full technical deep dive available here: https://www.zeroday.cloud/blog/redis-cve-2026-23479-deep-dive

A public PoC exploits a Redis RCE use-after-free flaw tied to CVE-2026-23479, running system commands as the Redis server. Update to 8.8.2. #Redis #RCE #UseAfterFree #CVE202623479 #InfoSec https://securityonline.info/redis-rce-use-after-free-poc/

A PoC/exploit has been discovered for vulnerability CVE-2026-23479 Vendor: redis Product: redis Description: Redis is an in-memory data structure store. In redis-server from 7.2.0 until 8.6.3, the unblock client flow does not handle an error return from processCommandAndResetClient when re-executing a blocked command. If a blocked client is evicted during this flow, an authenticated attacker can trigger a use-after-free that may lead to remote code execution. This has been patched in version 8.6.3. Link: https://github.com/v12-security/pocs/tree/main/redis/server #dbugs_vuln

Get the full technical breakdown of this bug here: https://www.zeroday.cloud/blog/redis-cve-2026-23479-deep-dive

Redis CVE-2026-23479 is not just a Stream issue. At Cipher Security Labs, we reconstructed the unblockClientOnKey() UAF and measured additional trigger surfaces. Key finding: stream-only ACL hardening is incomplete. Full research: https://ciphersecuritylabs.com/research/articles/a-measured-look-at-redis-cve-2026-23479-unblock-uaf-variant-surfaces-and-mitigation-reality

Redisで複数の深刻な脆弱性が修正。CVE-2026-23479、CVE-2026-25243、CVE-2026-25588、CVE-2026-25589のいずれもCVSSスコア7.7で、認証後ユーザによるメモリ破壊での遠隔コード実行。深刻度「中」の解放後メモリ使用CVE-2026-23631と併せ修正。 https://gbhackers.com/redis-security-flaws-expose-servers/

CVE-2026-23479 Redis RCE Vulnerability: A Two-Year Use-After-Free Flaw Discovered by AI | CIP Blog | Criminal IP https://www.criminalip.io/knowledge-hub/blog/35364

Redisに、ヒープuse-after-freeからリモートコード実行につながる脆弱性「CVE-2026-23479」が見つかり、研究者がPoCを公開した。通常のTCPコマンド経由で悪用でき、Redis 8.8.2で修正された。 問題はブロック中クライアントの処理で発生するuse-after-freeだ。あるクライアントのコマンド再実行時、同じリスト上の別クライアントが解放され、次のループで解放済みメモリを有効なクライアントとして参照してしまう。 研究者はヒープ配置の調整とポインタ読み取りを組み合わせ、任意のシステムコマンド実行まで到達する攻撃チェーンを示した。モジュール読み込み、ファイル書き込み、再起動は不要で、通常のTCPコマンドだけを利用する。 ただし、攻撃にはCONFIG SETなどを実行できる権限が必要とされる。記事によると、実際の攻撃での悪用は確認されていない。 検証対象はRedis 8.8.0で、関連する元の脆弱性はRedis 7.2.0までさかのぼる。修正版8.8.2では別のメモリ破壊脆弱性CVE-2026-62356も修正された。 https://securityonline.info/redis-rce-use-after-free-poc/

🤖 AI uncovered a Redis vulnerability hidden in stable releases for nearly two years. CVE-2026-23479 is an authenticated use-after-free flaw that may lead to remote code execution under specific conditions. 🔎 Criminal IP findings: • ~74,000 internet-exposed Redis assets • 16,090 assets potentially affected • 2,166 assets running Redis 8.6.2 Authentication alone does not eliminate risk when exposed instances use weak credentials or excessive ACL permissions. 📄Read the full analysis: https://criminalip.io/knowledge-hub/blog/35364 #Redis #CyberSecurity #RCE #AttackSurface #ThreatIntelligence

Redisの2年モノのRCE脆弱性（CVE-2026-23479）、コードレビューじゃなく自律型AIツールが発見したやつ。 自分も結構お世話になってるから調べてみた。 やることはシンプル: ① ポート(6379)の解放確認 ② 認証/権限の開放確認 ③ affectedなら fixed minorへ ネット非公開＆生Redis触れない構成なら落ち着いて対応でOK。

Autonomous AI Tool Finds 2-Year-Old RCE Flaw in Redis (CVE-2026-23479) https://thehackernews.com/2026/06/autonomous-ai-tool-finds-2-year-old-rce.html?m=1

Autonomous AI Tool Finds 2-Year-Old RCE Flaw in Redis (CVE-2026-23479) https://thehackernews.com/2026/06/autonomous-ai-tool-finds-2-year-old-rce.html?utm_source=dlvr.it&utm_medium=twitter

An autonomous AI tool just found what two years of human code review missed: a use-after-free in Redis that reaches all the way to remote code execution. CVE-2026-23479. CVSS 8.8. The flaw was introduced in Redis 7.2.0 — May 2023 — and lived undetected in every stable branch until it was patched in 8.6.3 on May 5, 2026. Two years of cloud caches, session stores, rate-limiters, and message queues running exploitable code. We are nothing if not consistent. The mechanics: the vulnerability lives in the unblock_client flow, specifically the error-handling path from processCommandAndResetClient. When a blocked client is evicted during re-execution, an authenticated attacker can trigger the use-after-free and land OS command execution on the server. It's exactly the kind of subtle memory-management edge case that slips through code review — the kind of thing that requires systematic automated reasoning to catch, not a second pair of human eyes on a PR. The PR:L requirement — low-privilege authentication — is the one thing keeping this from being a catastrophic internet-wide story right now. An attacker needs a valid Redis credential first. That bar is lower than it sounds. Redis credentials leak in public repos, .env files, and misconfigured cloud deployments with depressing regularity. Redis is on the honor system, apparently. A few things worth underscoring beyond the headline CVE: This was a batch remediation, not a single-bug patch. The Redis security advisory covers at least four CVEs in the same drop — CVE-2026-23479, CVE-2026-25243, CVE-2026-25588, and CVE-2026-25589. If you're patching, patch the whole batch. No public PoC yet, no KEV listing, no confirmed wild exploitation — but that window is running. For a CVSS 8.8 RCE in a ubiquitous datastore, reconstructing the use-after-free from the patch diff is a standard adversarial workflow. Days to weeks, not months. The fact that an AI tool found it means the research community will want to reproduce it. That accelerates the timeline. Redis is the session and cache layer in a significant percentage of AI application backends — LLM inference pipelines, RAG stores, agent memory layers. Any deployment still running 7.2.0 through 8.6.2 should be treated as exposed until patched. The specific CVE matters. The broader signal matters more. Autonomous AI tools are now finding two-year-old critical flaws in production infrastructure at scale. Defenders using that capability find bugs before attackers do. Defenders not using it don't. That asymmetry is widening, and this is a proof point. CWE-416 — Use After Free | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N | Fixed: Redis 8.6.3

An autonomous AI bug-hunter just surfaced a 2-year-old use-after-free RCE in Redis (CVE-2026-23479) that sat unnoticed across every stable branch since 7.2.0. (1/3)

An autonomous AI security tool has discovered a critical Redis remote code execution vulnerability that remained hidden for more than two years. In this episode of IT SPARC Cast – CVE of the Week, @JohnBarger and @loudoggeek discuss CVE-2026-23479, why Redis is such a critical part of modern cloud infrastructure, and how AI is fundamentally changing vulnerability discovery, patch management, and enterprise security operations. Youtube Episode 39 - https://youtu.be/bmwj1Lw-Usk&utm_source=x&utm_medium=organic_social&utm_campaign=it_sparc_cast&utm_content=post YouTube Channel - https://www.youtube.com/@sparccast Apple Podcast Link - https://podcasts.apple.com/us/podcast/it-sparc-cast/id1765417728 Spotify Link - https://open.spotify.com/show/6bzVql2gpV6aVqX8oAAPls Amazon Podcast Link - https://music.amazon.com/podcasts/ea33693d-f555-4a7c-8c36-d321ab5cfed2/it-sparc-cast?ref=dm_sh_MPp9hVbtUJhlG3cN3xhfN5YN3 Acast Link - https://shows.acast.com/it-sparc-cast

【Redisの認証済みRCE脆弱性 CVE-2026-23479】 Redisで、認証済みユーザーが任意OSコマンド実行につなげ得るCVE-2026-23479が修正されました。 この脆弱性はUse-After-Freeに関係し、Redis 7.2.0以降の一部バージョンに影響します。 認証が必要な脆弱性ではありますが、Redisがインターネットに露出している、デフォルトユーザー権限が強い、アプリケーション用アカウントに過剰なACLがある場合は影響が大きくなります。 SOCでは、Redisのバージョン、外部公開有無、`CONFIG`や`EVAL`の実行履歴、Redisホストからの不審なプロセス起動や外部通信を確認してください。 #Redis #CVE #RCE #脆弱性管理 #クラウドセキュリティ #SOC https://thehackernews.com/2026/06/autonomous-ai-tool-finds-2-year-old-rce.html

⚠️ Vulnerabilidades en productos Redis ❗ CVE-2026-25589 ❗ CVE-2026-25588 ❗ CVE-2026-23479 ➡️ Más info: https://www.cert.gov.py/vulnerabilidades-en-productos-redis/ https://t.co/YT4eMlEYZW