Autonomous AI Tool Finds 2-Year-Old RCE Flaw in Redis (CVE-2026-23479)
A 2-year-old remote code execution (RCE) vulnerability, CVE-2026-23479, was discovered in Redis 7.2.0 by an autonomous AI security tool, Team Xint Code. The flaw, stemming from a use-after-free issue in the `unblockClientOnKey()` function, allowed attackers to execute arbitrary commands on Redis instances, particularly those running in cloud environments without proper security configurations. While Redis initially reported no exploitation, the public disclosure of the vulnerability and exploit chain significantly elevates the risk of exploitation.
The vulnerability, tracked as CVE-2026-23479, was identified by Team Xint Code, an autonomous AI security tool, and was present in Redis 7.2.0 for over two years, undetected during security reviews. The flaw involves a use-after-free (CWE-416) in the `unblockClientOnKey()` function, which allows an attacker to leak a heap address, free a client, and then overwrite a function pointer within Redis's memory accounting. This chain of events ultimately leads to remote code execution (RCE). Wiz's analysis highlighted that a large percentage of Redis deployments in cloud environments were vulnerable due to the default configuration, where the default user possesses excessive privileges. The vulnerability was created through two commits, one in January 2023 and another in March 2023, and was demonstrated at ZeroDay.Cloud 2025. Redis has released patches (7.2.14, 7.4.9, 8.2.6, 8.4.3, and 8.6.3) to address the issue, and Redis Cloud has already applied the fixes.