Critical Redis RCE CVE-2022-XXXXX Lets Attackers Control Host Servers

Key Takeaways

• A critical post-authentication remote code execution (RCE) vulnerability, dubbed DarkReplica (CVE-2026-23631), was discovered in Redis.
• The flaw allows authenticated attackers to gain full control over the host server running the affected Redis instance.
• The vulnerability impacts multiple Redis release series, including 7.2.x, 7.4.x, 8.2.x, 8.4.x, and 8.6.x.
• Patches were released on May 5, 2026, and immediate upgrades are strongly recommended for all Redis operators.

Redis developers addressed a critical post-authentication remote code execution (RCE) vulnerability in May 2026. Identified as DarkReplica and assigned CVE-2026-23631, this severe flaw enables attackers to seize complete control of a Redis host server.

Redis incorporates powerful server-side Lua engines, providing administrators with the capability to execute custom logic directly within the database. The system features two such engines: an older scripting engine and a more modern functions engine, which manages library storage and synchronizes them across nodes.

DarkReplica specifically exploits a weakness within the functions engine during the replication process. An attacker who successfully authenticates to a Redis instance can command that server to act as a replica of an attacker-controlled master using the SLAVEOF command.

During this synchronization, the replica server may load a new function context from the incoming RDB (Redis dump) file, a critical moment that the vulnerability exploits.

Redis RCE Vulnerability Details

The vulnerability was uncovered during a 2025 research initiative by ZeroDay.Cloud. Their findings underscore how intricate features and unforeseen interactions can introduce severe security risks.

Redis is designed to manage long-running Lua functions by periodically yielding control to process other events, a mechanism crucial for features like FUNCTION KILL. However, a critical loophole emerges when replication events are processed while a slow Lua function is paused.

In this scenario, the replication handler inadvertently frees the currently running Lua engine and replaces it with a new context, without preventing the previously paused function from resuming. This leads to a use-after-free condition, as the paused function attempts to continue execution with its lua_State and associated objects having been deallocated.

Exploiting this condition, while complex, proved practical for researchers. They developed sophisticated primitives to leak heap addresses, enforce deterministic heap allocations, and fabricate Lua objects. By executing the vulnerable code within coroutines and meticulously manipulating the Lua memory arena, they managed to regain control over the Lua VM. This allowed them to establish read/write primitives.

Leveraging these capabilities, the researchers redirected internal function pointers to invoke standard C library functions. This ultimately enabled them to execute arbitrary system commands, culminating in full remote code execution on the compromised host.

The vulnerability affected numerous actively maintained Redis release series. Patches were officially released on May 5, 2026, covering versions 7.2.x, 7.4.x, 8.2.x, 8.4.x, and 8.6.x. Operators are urged to upgrade to these fixed releases without delay and to conduct thorough audits of any exposed Redis instances.

Given that exploitation necessitates authentication and advanced memory manipulation, the risk is highest for Redis servers configured with weak or absent credentials, or in environments where attackers can readily acquire valid authentication details. This incident highlights that complex in-process scripting and replication features significantly expand the attack surface, emphasizing the critical need for meticulous synchronization and lifecycle management within such systems.

What You Should Do

• Immediately upgrade all Redis instances to the patched versions (7.2.x, 7.4.x, 8.2.x, 8.4.x, 8.6.x released on May 5, 2026, or newer).
• Enforce strong authentication mechanisms for all Redis instances, utilizing robust passwords or alternative secure authentication methods.
• Implement strict network access controls (e.g., firewalls) to limit Redis server exposure, ensuring it is only accessible from trusted IP addresses and internal networks.
• Regularly audit Redis configurations to identify and remediate any misconfigurations that could weaken security, such as exposed instances or default credentials.
• Monitor Redis logs for unusual activity, unexpected configuration changes, or attempts to modify replication settings.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.