Autonomous AI Tool Finds 2-Year-Old RCE Flaw in Redis (CVE-2026-23479)

Summary: CVE-2026-23479 is a use-after-free (CWE-416) in Redis's unblockClientOnKey() in src/blocked.c, introduced in Redis 7.2.0 and present in every stable branch until fixes on May 5, unnoticed for over two years. It was reported by Team Xint Code, an autonomous AI security tool, rated 8.8 under CVSS 3.1 by NVD and 7.7 under CVSS 4.0 by Redis, and demonstrated as working RCE at ZeroDay.Cloud 2025 in London last December.
What you should know: Wiz's analysis puts Redis in a large majority of cloud environments, most running without a password, and the default user already holds every privilege the chain needs - CONFIG SET, EVAL, stream commands, and basic read/write. The full technical chain is now public, and Redis said it had no evidence of exploitation in its own or customer environments, with no public in-the-wild reports as of publication.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2026-23479
Related: ⚡ Weekly Recap: Exchange 0-Day, npm Worm, Fake AI Repo, Cisco Exploit and More Cyber Risks ·
⚡ Weekly Recap: Instagram Account Hacks, Android Zero-Day, GitHub Worm and More Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026