---
schema: 1
kind: vulnerability
title: "Redis CVE-2026-23479: a public use-after-free→GOT-overwrite RCE in a database 80% of cloud estates run passwordless"
headline: "Redis CVE-2026-23479: a public use-after-free→GOT-overwrite RCE in a database 80% of cloud estates run passwordless"
summary: "A fully public Redis exploit chain turns a two-year-old use-after-free into host RCE — and ~85% of cloud Redis runs passwordless, so \"authenticated\" is academic. CVE-2026-23479 grooms a freed client object and abuses Redis's own memory-accounting routine to overwrite the GOT, redirecting strcasecmp() to system(). Patched 2026-05-05; no ITW yet (ZeroDay.Cloud, 2026-06-02)."
discovered_at: "2026-06-05T05:00:08Z"
event_date: 2026-06-03
run_id: 2026-06-05-2c6574c4
priority: high
immediate_action: null
tags:
  - vulnerabilities
  - rce
  - poc-public
  - patch-available
  - default-config
  - cloud
regions:
  - global
sectors:
  - technology
entities: []
cves:
  - id: CVE-2026-23479
    cvss: "8.8"
    epss: null
    type: rce
    vector: zero-click
    auth: post-auth
    status:
      - poc-public
      - patch-available
sources:
  - url: "https://www.zeroday.cloud/blog/redis-cve-2026-23479-deep-dive"
    publisher: "ZeroDay.Cloud, 2026-06-02"
    role: primary
  - url: "https://redis.io/blog/security-advisory-cve202623479-cve202625243-cve-2026-25588-cve202625589-cve-2026-23631/"
    publisher: "Redis, 2026-05-05"
    role: corroborating
  - url: "https://thehackernews.com/2026/06/autonomous-ai-tool-finds-2-year-old-rce.html"
    publisher: "The Hacker News, 2026-06-03"
    role: corroborating
closed_sources: []
evidence: []
verification: multi-source
sourcing_note: null
confidence: high
update_of: null
references: []
deep_dive: true
deep_dive_category: cloud-saas
org_triage: null
watchlist_hit: false
actions: []
migrated_from: briefs/2026-06-05.md
---

Theori's autonomous vulnerability-discovery tool **Xint Code** (credited to Team Xint Code — Tim Becker, Jacob Newman, Juno IM) found CVE-2026-23479, a use-after-free in Redis's blocking-client code path that an authenticated client can drive to remote code execution on the host. The full exploit chain became public on 2 June 2026 in the write-up from the Wiz-run ZeroDay.Cloud 2025 competition, coinciding with the patch release ([ZeroDay.Cloud, 2026-06-02](https://www.zeroday.cloud/blog/redis-cve-2026-23479-deep-dive)). Redis disclosed it on 5 May among five flaws it patched that day — four rated High and RCE-class (CVE-2026-23479, -25243, -25588, -25589) plus one Medium-severity Lua use-after-free ([Redis, 2026-05-05](https://redis.io/blog/security-advisory-cve202623479-cve202625243-cve-2026-25588-cve202625589-cve-2026-23631/); [The Hacker News, 2026-06-03](https://thehackernews.com/2026/06/autonomous-ai-tool-finds-2-year-old-rce.html)).

**Root cause.** `unblockClientOnKey()` in `src/blocked.c` calls `processCommandAndResetClient()` without checking whether the client object was freed as a side effect of client eviction during that command's processing. Because Redis's `zfree()` does not zero memory, the freed client slot keeps stale-but-valid-looking bytes and the function keeps operating on freed memory. The defect was introduced across two commits that landed in Redis 7.2-rc1 and shipped in 7.2.0 (January 2023's PR #11012 added the unchecked reset call; a March 2023 change removed the preceding NULL guard), and it survived undetected in every stable branch for over two years.

**Exploitation chain.** The public PoC is a deliberate three-stage memory-grooming sequence:

1. **Heap-address leak (`T1203`)** — an `EVAL` one-liner (`return tostring(redis.call)`) leaks a Lua heap pointer, defeating ASLR for the next stages.
2. **Use-after-free groom** — the attacker manipulates client memory limits via `CONFIG SET`, parks a bloated client on a stream with `XREAD`, then collapses the limits to force eviction (the free), and reclaims the freed slot with a pipelined `SET` carrying a forged client structure.
3. **GOT overwrite → `system()`** — Redis's own `updateClientMemoryUsage()` performs an out-of-bounds decrement using attacker-controlled fields in the forged client, writing into the **Global Offset Table**. The official Redis Docker image ships with only partial RELRO, leaving the GOT writable, so the write repoints `strcasecmp()` to `system()` and the next command string is executed as an OS command (`T1059`).

**The "authenticated" caveat barely applies.** The chain needs a session whose ACL grants `@admin` (CONFIG SET), `@scripting` (EVAL), `@stream` (XREAD/XADD) and `@read`/`@write` — which is exactly the **default user** in a stock deployment. The write-up reports Redis is present in ~80% of cloud environments and that ~85% of those instances run **without a password**, so in the common case the "authentication" prerequisite is satisfied by anyone who can reach the port. There is **no confirmed in-the-wild exploitation**, but the chain is fully public and Redis is ubiquitous, so this is an asset-enumeration priority even before patching. NVD scores it 8.8 (CVSS 3.1); Redis scores it 7.7 (CVSS 4.0).

**Affected and fixed.** Vulnerable: 7.2.0–7.2.13, 7.4.0–7.4.8, 8.2.0–8.2.5, 8.4.0–8.4.2, 8.6.0–8.6.2. Fixed 2026-05-05 in **7.2.14, 7.4.9, 8.2.6, 8.4.3, 8.6.3**; Redis Cloud is already patched.

**Hunt and detection concepts.** This exploit is loud in Redis's own telemetry if you collect it. Enable the slow log (`slowlog-log-slower-than 0` captures every `EVAL` and `CONFIG SET`) and alert on the signature *sequence* rather than any single command: an `EVAL` returning an unusually long string, immediately followed by rapid `CONFIG SET maxmemory*` churn and pipelined `XADD`/`XREAD`/`SET` from a single client. At the OS layer the decisive signal is **`redis-server` spawning any child process** — a normal Redis never does (Sysmon-for-Linux / `auditd` `execve` with parent `redis-server`; on Windows-hosted Redis, Sysmon EID 1 with parent-image filter). Audit `ACL LIST` for any user — especially `default` — that simultaneously holds `CONFIG`, `EVAL` and stream commands.

**Hardening / mitigation.** Patch to the fixed builds. Where patching lags, you can break specific stages of the chain via ACL least-privilege without touching the binary: deny `CONFIG` to application users (breaks stage 2), deny `@scripting`/`EVAL` if Lua is unused (kills the stage-1 leak), and split `@admin` away from the application role. Independently, **require a password** and bind Redis off the public internet behind TLS and network policy — that alone removes the unauthenticated-in-practice exposure that makes this widely critical. Rotate any broadly shared credential that combines admin, scripting and stream privileges. ATT&CK: [`T1203`](https://attack.mitre.org/techniques/T1203/), [`T1059`](https://attack.mitre.org/techniques/T1059/).