Chinese AI lab Moonshot's Kimi K3 model, operating as autonomous agents, discovered 19 previously unknown Redis vulnerabilities and built working RCE exploits — all in approximately 90 minutes. The findings, disclosed July 24, 2026, prompted Redis to ship seven emergency security releases across versions 6.2, 7.2, 7.4, 8.2, 8.4, 8.6, and 8.8. This marks the first publicly documented case of AI agents independently discovering, validating, and weaponizing zero-day vulnerabilities at scale.
What Happened
On July 23, 2026, researchers from Bera Buddies (self-described as "AI Agent Research") published PoC exploits for multiple Redis RCE chains discovered by Kimi K3 agents. The agents were tasked with auditing Redis source code for memory safety violations. Within 90 minutes, they identified 19 distinct zero-day vulnerabilities across the Redis Streams and RedisBloom/TDigest components, produced working exploits for two primary chains, and validated them against current Redis releases.
Redis responded the same day with seven coordinated security releases:
- Redis 6.2.23 — fixes Streams shared-NACK use-after-free
- Redis 7.2.15 — fixes Streams shared-NACK use-after-free
- Redis 7.4.10 — fixes both Streams and RedisBloom TDigest OOB writes
- Redis 8.2.8 — fixes both chains
- Redis 8.4.5 — fixes both chains
- Redis 8.6.5 — fixes both chains (Streams guard was missing in 8.6.4)
- Redis 8.8.1 — fixes RedisBloom/TDigest loader (Streams guard already present in 8.8.0)
Critical detail: Redis 6.2.22 and 7.4.9 — the versions users were told to upgrade to in May 2026 — did not contain the fix for the Streams shared-NACK flaw. The fix (PR #15081) only landed in 7.4.10/8.6.5/8.8.0. Anyone who "updated in May" is still vulnerable.
The Two Exploit Chains
Chain 1: Redis Streams Shared-NACK Use-After-Free (CVE-2026-25589 family)
Affected: Redis 6.2.22, 7.4.9, 8.6.4 (and earlier in each series)
The vulnerability exists in the Redis Streams consumer group implementation. A maliciously crafted RDB file can create a scenario where two consumers reference the same streamNACK object (pending-entry tracking structure). When the first consumer is removed, the streamNACK is freed. The second consumer retains a dangling pointer. Removing the second consumer triggers a double-free, which the exploit converts into arbitrary memory read/write primitives.
Exploit flow:
- Craft RDB with corrupt streamNACK ownership (two consumers → same entry)
RESTOREthe RDB → Redis loads corrupt stateXGROUP DELCONSUMERfor consumer A → frees shared streamNACKXGROUP DELCONSUMERfor consumer B → double-free → heap corruption- Heap grooming → overwrite function pointer →
system()call
The published exploit (P86_exploit.py) targets Redis 8.6.4, demonstrating the chain from RESTORE to RCE without authentication (if RESTORE is permitted).
Chain 2: RedisBloom TDigest RDB Loader Out-of-Bounds Write
Affected: Redis 8.8.0 (with RedisBloom module)
The RedisBloom module's TDigest probabilistic data structure deserializer trusts a capacity field in the RDB payload without validating it against the actual allocated centroid array size. A small allocation paired with a large capacity value causes an out-of-bounds write during RDB loading.
Exploit flow:
- Craft RDB with TDigest payload: tiny allocation, huge
capacity RESTOREthe key → RedisBloom loader writes past allocation boundary- Heap corruption → arbitrary read/write → leak libc/Redis bases
- Overwrite hash function pointer →
system()on craftedGET
The exploit (P88W_exploit.py) demonstrates full RCE against Redis 8.8.0 with RedisBloom loaded.
Why This Matters to Developers
Redis Is Everywhere
Redis runs as cache, session store, message queue, rate limiter, and feature flag backend in virtually every modern stack. A remote code execution in Redis means:
- Cache poisoning → serve malicious content to users
- Session hijacking → take over user accounts
- Queue manipulation → inject/alter background jobs
- Data exfiltration → dump all cached PII, tokens, secrets
- Lateral movement → Redis often has network access to app servers, databases
The RESTORE Command Is the Attack Vector
Both chains require the RESTORE command (loads RDB payload). By default, Redis 6.0+ permits RESTORE for authenticated users. Many deployments:
- Run with no authentication (dangerous but default
bind 127.0.0.1only) - Expose Redis to internal networks where compromised containers/VMs can reach it
- Grant broad command permissions to application users
The May 2026 "Fix" Was Incomplete
Redis patched CVE-2026-25243 and CVE-2026-25589 in May 2026 (releases 6.2.22, 7.2.14, 7.4.9). The July 2026 discovery reveals the May patch did not fix the root cause for the Streams shared-NACK flaw. The fix (ownership guard in rdb.c) was only merged in PR #15081, which shipped in 7.4.10, 8.6.5, 8.8.0. If you upgraded in May and stopped there, you're still vulnerable.
Affected Versions & Fixed Versions
| Series | Vulnerable | Fixed | Chain(s) Fixed |
|---|---|---|---|
| 6.2 | ≤ 6.2.22 | 6.2.23 | Streams |
| 7.2 | ≤ 7.2.14 | 7.2.15 | Streams |
| 7.4 | ≤ 7.4.9 | 7.4.10 | Streams + RedisBloom |
| 8.2 | ≤ 8.2.7 | 8.2.8 | Streams + RedisBloom |
| 8.4 | ≤ 8.4.4 | 8.4.5 | Streams + RedisBloom |
| 8.6 | ≤ 8.6.4 | 8.6.5 | Streams + RedisBloom |
| 8.8 | 8.8.0 | 8.8.1 | RedisBloom (Streams fixed in 8.8.0) |
No CVE assigned yet for the July 2026 findings. NVD still lists the May 2026 CVEs. Redis has not published new CVE IDs as of July 24.
Mitigation: Immediate Actions
1. Upgrade to Fixed Versions Now
2. Restrict RESTORE Command
If you cannot upgrade immediately, disable RESTORE for non-admin users:
3. Network-Level Controls
- Bind Redis to localhost only:
bind 127.0.0.1 - Use firewall rules to restrict Redis port (6379) to application servers only
- Enable TLS (
tls-port 6380) and require client certificates
4. Monitor for Exploitation
Detection Rules
Suricata: Redis RESTORE with Large Payload
alert tcp any any -> $REDIS_SERVERS 6379 (
msg:"ET EXPLOIT Redis RESTORE Large Payload Potential RCE";
flow:to_server,established;
content:"RESTORE"; nocase;
content:"
$"; pcre:"/RESTORE\s+\w+\s+\d+\s+/";
threshold:type both, track by_src, count 5, seconds 60;
classtype:attempted-admin;
sid:2026002; rev:1;
metadata:created_at 2026-07-24;
)
YARA: Malicious RDB Payload Patterns
Sigma: Redis RESTORE Command in Audit Logs
Frequently Asked Questions
Q: Are there CVEs for these 19 vulnerabilities?
A: Not yet. As of July 24, 2026, NVD lists only the May 2026 CVEs (CVE-2026-25243, CVE-2026-25589). Redis has not requested new CVE IDs for the July findings. Track Redis GitHub releases and security announcements.
Q: Does authentication protect me?
A: Partially. Both exploits require RESTORE permission. Default Redis ACLs grant RESTORE to authenticated users. You must explicitly revoke it: ACL SETUSER appuser -RESTORE.
Q: Is Redis 8.8.0 safe?
A: For the Streams chain — yes (fixed in 8.8.0). For the RedisBloom chain — no, upgrade to 8.8.1.
Q: Can this be exploited without RESTORE?
A: Currently, no public exploit bypasses RESTORE. The vulnerability is in RDB deserialization. However, future research may find alternative trigger paths (replication, AOF loading, module APIs).
Q: How do I know if I was compromised?
A: Check for unexpected RESTORE commands in slowlog, unusual XGROUP DELCONSUMER activity, unknown keys appearing, or outbound connections from Redis host. The exploits leave traces in Redis command logs.
Q: What about managed Redis (AWS ElastiCache, Azure Cache, Redis Cloud)?
A: Cloud providers typically patch within 24–48 hours. Check your provider's security bulletin. For ElastiCache, verify the engine version in console and apply pending maintenance.
Key Takeaways
- AI-driven vulnerability discovery is real — Kimi K3 agents found 19 zero-days in 90 minutes. This is the new baseline.
- The May 2026 Redis patches were incomplete — verify you're on July 2026 releases (7.4.10+, 8.6.5+, 8.8.1+).
RESTOREis a dangerous command — disable it unless you need RDB import functionality.- Redis version numbers matter — 6.2.22 ≠ 6.2.23; 7.4.9 ≠ 7.4.10. Check exact patch version.
- Managed services ≠ automatic safety — confirm your cloud provider has applied the July 23 patches.
Conclusion
The Kimi K3 Redis discovery isn't just another CVE — it's a milestone. Autonomous AI agents can now perform the full vulnerability lifecycle: discovery, analysis, exploit development, and validation. For defenders, this means the "time to exploit" for complex memory corruption bugs has collapsed from weeks/months to hours. Patch management cycles designed for human-speed disclosure are obsolete. If you run Redis, upgrade today. If you run any memory-unsafe infrastructure, assume AI-accelerated zero-day discovery is already targeting it.
Sources:
- The Hacker News: Kimi K3 Agents Found Redis Zero-Days
- Bera Buddies Redis PoC Repository
- Redis 7.4.10 Release Notes
- Redis 8.6.5 Release Notes
- Redis 8.8.1 Release Notes
- Lyutoon Redis RCE PoC
Automated Transmission
This entry was synthesized and populated dynamically using native API integrations.