Critical Redis RCE Vulnerability (CVE-2026-23631) Patched in May 2026 In May 2026, Redis developers addressed a severe post-authentication remote code execution (RCE) vulnerability, tracked as CVE-2026-23631 and dubbed DarkReplica, which enabled attackers to fully compromise affected Redis hosts. The flaw stemmed from the functions engine, a feature allowing administrators to execute custom Lua logic within Redis. During replication, an authenticated attacker could manipulate a Redis instance into becoming a replica of a malicious master using the SLAVEOF command. When synchronizing, the server would load a new function context from an attacker-controlled RDB (Redis dump) file, triggering a use-after-free condition. The vulnerability arose from a race condition in Redis’s handling of paused Lua functions. While long-running functions periodically yield to process events, the replication handler could free the active Lua engine and replace it with a new context without preventing the paused function from resuming. This allowed the function to execute with freed memory, creating an exploitable state. Researchers from ZeroDay.Cloud demonstrated the attack by crafting memory manipulation primitives, including heap address leaks and fake Lua objects, to gain control of the Lua VM. From there, they redirected function pointers to execute arbitrary system commands, achieving full RCE. The flaw affected multiple Redis release series, including 7.2.x, 7.4.x, 8.2.x, 8.4.x, and 8.6.x, with patches released on May 5, 2026. Exploitation requires authentication, making misconfigured servers with weak or default credentials the most vulnerable. The incident underscores the risks of complex in-process scripting and replication features, particularly when synchronization and lifecycle management are not tightly controlled. A technical write-up and proof-of-concept exploit were published, prompting vendors and cloud security tools to issue detection advisories for affected installations.

Redis disclosed CVE-2025-49844 (RediShell), a critical CVSS 10.0 vulnerability in its in-memory database software, allowing authenticated attackers to exploit a use-after-free (UAF) memory corruption bug via malicious Lua scripts. This flaw, present for 13 years, enables remote code execution (RCE), granting full host system access. Attackers could steal credentials, exfiltrate sensitive data, deploy malware (e.g., ransomware), or pivot to other cloud services. The vulnerability affects all Redis versions prior to 6.2.20, 7.2.11, 7.4.6, 8.0.4, and 8.2.2, with ~330,000 exposed instances globally, including 60,000 unprotected by authentication. While no in-the-wild exploitation is confirmed, Redis instances are prime targets for cryptojacking, botnet recruitment, and data breaches. Immediate mitigation requires patching, restricting Lua script execution via ACLs, and enforcing strong authentication. Failure to act risks large-scale data theft, system hijacking, or lateral movement across cloud environments, posing severe operational and reputational damage.

Redis, the company behind the widely used in-memory data store, disclosed a critical vulnerability (CVE-2025-49844, dubbed RediShell) allowing attackers to escape the Lua sandbox and execute arbitrary native code on the host system via a use-after-free memory corruption bug. The flaw, present since 2012, affects Redis versions with Lua scripting (v8.2.1 and earlier). Worse, 57% of cloud Redis deployments use default container images with authentication disabled, exposing ~60,000 internet-facing instances globally to remote code execution (RCE) risks. Exploitation could lead to persistent access, cryptomining, data exfiltration (Redis/host), credential theft (e.g., IAM tokens for lateral cloud movement), and full system compromise. German authorities warned of imminent attacks due to the flaw’s simplicity and Redis’ ubiquity. Patches are available, but unpatched systems remain at severe risk of complete takeover, especially if exposed without authentication or proper ACLs.