Redis RCE PoCs: Patch July 2026 Security Releases

Redis administrators should check branch versions again after the July 23 security releases. Redis published updates for several supported lines after public proof-of-concept research showed authenticated paths from crafted RESTORE payloads toward remote code execution in stock Redis builds.^[1]

The practical fix is branch-specific: move to Redis 6.2.23, 7.2.15, 7.4.10, 8.2.8, 8.4.5, 8.6.5, or 8.8.1, depending on the line in production. Redis release notes mark these as security releases published on July 23, 2026.^[1][2][3]

This is not a “Redis is open to the internet” warning. The reported chains require an authenticated path and the ability to use dangerous commands or modules. That still matters because Redis often sits inside application, CI, AI-agent, queue, cache, and Kubernetes environments where service credentials are shared too broadly. If a web app, worker, or agent token can execute RESTORE, the Redis boundary may be weaker than expected.

What To Patch And What To Check

The first July issue affects stream data restored from a crafted payload. Redis 6.2.23, 7.2.15, and 7.4.10 describe a stream RESTORE payload that can make two consumers share the same NACK, creating a use-after-free condition that may lead to remote code execution.^[2] Redis 8.2.8, 8.4.5, and 8.6.5 include that streams fix as well.^[1]

The second path affects RedisBloom and TDigest loading. Redis 8.2.8, 8.4.5, 8.6.5, and 8.8.1 note that crafted RESTORE payloads in RedisBloom and TDigest may trigger out-of-bounds writes, also potentially leading to remote code execution.^[1][3]

The Hacker News reported that public PoCs targeted Redis 6.2.22, 7.4.9, 8.6.4, and 8.8.0, and that all four chains require RESTORE; the stream chains also need EVAL and XGROUP, while the Redis 8.8.0 path needs EVAL and the bundled RedisBloom module.^[4] Treat the AI-discovery claims around these PoCs as secondary context. Redis release notes confirm the shipped fixes; they do not validate the claimed number of zero-days or how autonomous the research process was.

For most teams, the immediate triage is simple. First, inventory Redis by exact branch, not by “recently patched” status, because some May security destinations were replaced by July fixes. Second, review ACLs for application users and remove RESTORE, EVAL, and module commands unless a service genuinely needs them. Third, keep Redis reachable only from trusted application networks, not from public ingress or broad Kubernetes namespaces.

Operators who use Redis in AI or automation stacks should be stricter. A compromised agent, poisoned plugin, or exposed workflow runner can turn “authenticated only” into a real attack path if its Redis account has administrative verbs. That is the same class of internal trust problem seen in LangGraph checkpointer issues, exposed AI-service botnets such as NadMesh, and Kubernetes-side isolation failures like the Argo CD repo-server RCE path.

There was no CISA KEV entry for a new Redis July issue in the catalog version checked during this run, and the public reporting reviewed did not claim in-the-wild exploitation as of July 24, 2026.^[4][5] That lowers the emergency level, but it does not make the update optional for exposed or shared Redis deployments. Authenticated RCE research tends to move quickly once PoCs are public.

References

1. Redis Open Source 8.6 release notes, “Redis 8.6.5,” released July 23, 2026.
2. Redis Community Edition 7.4 release notes, “Redis 7.4.10,” released July 23, 2026.
3. Redis Open Source 8.8 release notes, “Redis 8.8.1,” released July 23, 2026.
4. The Hacker News, “Kimi K3 Agents Found Redis Zero-Days and Built RCE Exploit, Researchers Say,” published July 24, 2026.
5. CISA Known Exploited Vulnerabilities catalog, checked July 25, 2026.