Recent research associated with the Kimi K3 AI agent has identified multiple authenticated remote code execution (RCE) vulnerabilities in Redis, a widely used in-memory data store. These vulnerabilities affect Redis versions 6.2.22, 7.4.9, 8.6.4, and 8.8.0, and involve a combination of a stream consumer-group shared-NACK double-free issue and a heap overflow in the RedisBloom TDigest module.
Details of the Vulnerabilities
The research highlights two primary vulnerabilities:
- Stream NACK Double-Free (CVE-2026-25589 Incomplete-Fix Family): This issue affects Redis versions 6.2.22, 7.4.9, and 8.6.4. The shared-NACK path in stream consumer groups can free the same heap chunk twice, providing an authenticated client with a reliable primitive for code execution.
- TDigest Heap Overflow (RedisBloom Module): In Redis version 8.8.0, while the NACK issue has been addressed, a newly identified heap overflow in the default TDigest implementation within the bundled RedisBloom module still enables RCE on a fresh instance.
Both vulnerabilities require commands commonly left enabled in internal deployments, such as EVAL, RESTORE, and XGROUP. Notably, version 8.8.0 includes the RedisBloom module by default, which is affected by the TDigest heap overflow.
Implications and Recommendations
Redis often operates behind application tiers with password protection but full command surface access. If an attacker obtains credentials through methods like secret leaks, server-side request forgery (SSRF), or misconfigured network access control lists (ACLs), they can escalate from data store access to executing commands on the host system without causing service disruptions that would typically indicate an attack.
The research indicates that the shared-NACK double-free vulnerability was only fully fixed in version 8.8.0. Older maintained versions remain exposed if equivalent patches have not been applied. Additionally, version 8.8.0 is not automatically secure, as the TDigest bug in the RedisBloom module remains unpatched at the time of disclosure.
To mitigate these risks, the following steps are recommended:
- Upgrade Redis: Apply fixed Redis builds as soon as they are available. Do not assume version 8.8.0 is fully secure if the RedisBloom module remains vulnerable.
- Restrict Dangerous Commands: Use the `rename-command` directive to disable or rename commands like EVAL and RESTORE, or implement Redis Access Control Lists (ACLs) to deny these commands for application users.
- Network Isolation: Bind Redis to private interfaces and avoid exposing port 6379 to the internet.
- Implement Strong Authentication: Use unique, strong passwords, avoid default credentials, and rotate secrets after any suspected leak.
- Audit Modules: Disable or uninstall unnecessary modules, especially if they are known to have vulnerabilities.
These vulnerabilities underscore the importance of proactive security measures in managing Redis deployments. Organizations should prioritize patching affected instances and implementing the recommended mitigations to protect their systems from potential exploitation.
