Redis Patches Authenticated RCE in Streams and RedisBloom, Found by AI Agents

On 23 July Redis shipped seven security updates for authenticated RCE bugs found by AI research agents. The set includes a Streams use-after-free and a RedisBloom TDigest out-of-bounds write, both triggerable via RESTORE.

Incident Overview

On 23 July 2026 Redis published seven security updates for serious authenticated remote code execution (Authenticated RCE) bugs. Researchers using AI agents such as Kimi K3 found the issues quickly, then published proof-of-concept (POC) exploit code, which pushed Redis to ship patches on an emergency timeline.

Redis has not assigned new CVE IDs, but confirmed the bugs and that POC code is public. No confirmed in-the-wild exploitation yet. Redis sits at the core of global cache, queue, and real-time data infrastructure, so security teams should treat this as a priority patch.

Technical Details

Bug 1: Streams use-after-free

In the Redis Streams type, a crafted Stream entry leaves a memory object in use after free (use-after-free) and corrupts memory. An attacker can load malicious serialized Stream data with the RESTORE command, trigger the bug, and get arbitrary code execution.

Bug 2: RedisBloom TDigest out-of-bounds write

The TDigest (t-digest) implementation in the RedisBloom module has an out-of-bounds write. Crafted TDigest operations write past the allocated buffer, smash memory, and lead to code execution. Also triggerable via RESTORE.

Bug 3: Related defects

The seven updates also cover other memory-safety issues in Streams and RedisBloom. Shared traits:

• All require authentication: a valid Redis credential is needed
• RESTORE as the entry point: all can be triggered with crafted RESTORE data
• Memory corruption: use-after-free and out-of-bounds write are the main classes

Role of AI agents

The Hacker News reported that researchers used a Kimi K3 AI agent to find this Redis set in under 30 minutes and build a full authenticated RCE chain. AI-assisted vuln discovery is now operational:

• Agents can autonomously scan a codebase for memory-safety patterns
• They can produce POC code quickly and shrink the validation cycle
• Defenders and attackers can use the same capability — AI vs AI

In the same period, Aikido's pentest AI agent found eight high-severity NodeBB bugs in a six-hour source review, reinforcing the trend.

Impact Assessment

Redis is the most widely used in-memory data structure store, including:

• Web app caches (WordPress object cache, session store)
• Distributed queues (Pub/Sub, Streams)
• Real-time leaderboards and counters
• ML feature stores
• Shared state in microservices

Auth is required, but risk stays high when:

• Instances use weak or default passwords (still common on the internet)
• Container deployments leak credentials and enable lateral movement
• Cloud-hosted Redis credentials leak via supply chain or misconfig
• Insiders who already have DB credentials escalate further

Remediation

Upgrade now

Redis says upgrade to the latest patched releases:

• Upgrade Redis Server to the latest official security release
• If you load RedisBloom, upgrade that module in lockstep
• Confirm loaded module versions with `INFO modules`

Temporary mitigations

• Harden auth: strong passwords on every instance; disable passwordless defaults
• Network isolation: restrict source IPs to Redis (default 6379); do not expose it to the internet
• Disable RESTORE: if you do not need restore, ACL-restrict the RESTORE command
• Enable TLS: encrypt Redis traffic so credentials are not stolen in transit
• Watch logs for RESTORE from unexpected clients

Detection

• Audit auth on every Redis instance; no empty or weak passwords
• Scan for internet-exposed Redis (Shodan/Censys)
• SIEM alert on abnormal RESTORE frequency
• Integrity-monitor the Redis data directory for unexpected binary loads

References

• Redis official security docs
• The Hacker News: Redis patches RCE bugs found by AI agents
• CyberSecBrief Daily Briefing (25 July 2026)
• Redis official download and release pages