Kimi K3 AI Agent Discovers Zero-Day Exploits in Redis Server

Key Takeaways

• A Kimi K3 AI agent-driven research initiative has unveiled multiple authenticated remote code execution (RCE) vulnerabilities in Redis.
• The vulnerabilities affect various Redis versions, including 6.2.22, 7.4.9, 8.6.4, and 8.8.0, stemming from a stream NACK double-free issue and a heap overflow in the RedisBloom TDigest module.
• Successful exploitation requires authentication and access to commands like EVAL, RESTORE, and XGROUP, which are often enabled in internal deployments.
• While Redis 8.8.0 addresses the NACK double-free, it remains susceptible to the TDigest heap overflow, which was unfixed at the time of disclosure.
• Defenders must implement a multi-layered security strategy beyond simple password protection, including upgrading, command restriction, network isolation, and module auditing.

A new cybersecurity research effort, leveraging the Kimi K3 AI agent, has uncovered several authenticated remote code execution (RCE) pathways within Redis, a widely used in-memory data store. These critical vulnerabilities affect multiple stock builds of Redis, potentially allowing attackers to gain host-level shells without crashing the service.

The findings, attributed to the researcher alias Bera Buddies, detail how combinations of a stream consumer-group shared-NACK double-free issue and a separate heap overflow in the bundled RedisBloom TDigest module can lead to RCE. Affected Redis versions include 6.2.22, 7.4.9, 8.6.4, and 8.8.0.

AI Agent Uncovers Zero-Day Vulnerabilities

The research team successfully demonstrated non-destructive RCE against official Redis Docker images by exploiting two distinct classes of bugs:

• Stream NACK Double-Free (CVE-2026-25589 family): This vulnerability impacts Redis versions 6.2.22, 7.4.9, and 8.6.4. It arises from an incomplete fix where the shared-NACK path in stream consumer groups can inadvertently free the same heap chunk twice. This provides an authenticated client with a reliable primitive for achieving code execution.
• TDigest Heap Overflow (RedisBloom module): For Redis 8.8.0, although the NACK issue was patched (PR #15081), a newly identified heap overflow within the default TDigest implementation still facilitates RCE on a fresh instance. This issue resides within the RedisBloom module, which ships by default with Redis 8.8.0.

Exploiting both vulnerability types necessitates the use of commands typically left enabled in internal Redis deployments, such as EVAL, RESTORE, and XGROUP. Additionally, version 8.8.0 requires the bundled RedisBloom module to be active.

Redis instances frequently operate behind application tiers, secured by a password but exposing their full command surface. This configuration means that if an attacker acquires valid credentials—through means like a secret leak, Server-Side Request Forgery (SSRF), or a misconfigured network Access Control List (ACL)—they can escalate from mere data store access to a host-level shell without triggering obvious attack indicators.

The research highlights that the shared-NACK double-free was only completely addressed in Redis 8.8.0. Consequently, older supported lines remain vulnerable if operators have not applied the corresponding patches. Furthermore, Redis 8.8.0 is not entirely secure, as the TDigest bug in its bundled module was reported as unfixed at the time of disclosure.

The TDigest exploitation path on 8.8.0 demonstrates notable layout sensitivity, relying on spraying structures to establish a deterministic jemalloc layout. This makes successful exploitation most probable on fresh instances with minimal concurrent traffic, conditions often found in lab environments, CI/CD pipelines, and lightly loaded production pods.

Affected Versions at a Glance

Post-exploitation, compromised Redis instances may exhibit inert keys or corrupted data structures. Operators are cautioned against indiscriminately running FLUSHALL/SAVE commands on a compromised 8.8.0 host without first understanding the residual state left by the attack.

What You Should Do

• Upgrade Promptly: Update to patched Redis builds as soon as they become available. Do not assume Redis 8.8.0 is fully secure if the RedisBloom/TDigest module remains vulnerable.
• Restrict Dangerous Commands: Use rename-command to disable or rename administrative primitives like EVAL, RESTORE, and XGROUP, or implement Redis ACLs to deny these commands for application users.
• Implement Network Isolation: Bind Redis instances to private network interfaces and never expose port 6379 directly to the internet.
• Strengthen Authentication: Employ unique, strong passwords, avoid default credentials, and rotate secrets immediately following any suspected compromise.
• Audit Modules: Disable or unload the RedisBloom/TDigest module if it is not actively used in your environment.
• Monitor for Anomalies: Continuously monitor for unusual usage patterns of XGROUP, RESTORE, and EVAL commands, as well as the presence of unexpected keys in data directories.

The research linked to the Kimi K3 AI agent serves as a stark reminder for 2026: AI-assisted vulnerability discovery is accelerating, making critical infrastructure like Redis prime targets. The existence of authenticated RCE through incomplete fixes and bundled modules demonstrates that merely “setting a password” is an insufficient security posture. Organizations utilizing Redis versions 6.2 through 8.8 must meticulously inventory their installations, secure their command surfaces, and diligently track official advisories from Redis and RedisBloom for comprehensive patches.

Further technical details on the Redis authenticated RCE vulnerabilities, including the stream NACK double-free and TDigest heap overflow, are available.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.