AI Agent Kimi K3 Discovers Multiple 0-Day RCE Vulnerabilities in Redis
An AI agent named Kimi K3 has identified critical remote code execution vulnerabilities in multiple versions of the widely-used Redis in-memory data store, including a double-free bug and a heap overflow.
A sophisticated AI agent, dubbed Kimi K3, has uncovered several authenticated remote code execution (RCE) vulnerabilities affecting multiple versions of Redis, a popular in-memory data structure store used as a cache, message broker, and database. The findings, attributed to researcher alias Bera Buddies, impact official builds of Redis versions 6.2.22, 7.4.9, 8.6.4, and 8.8.0. These vulnerabilities stem from two distinct bug classes: a stream consumer-group shared-NACK double-free issue and a heap overflow within the bundled RedisBloom TDigest module present in version 8.8.0.
The first vulnerability, a stream consumer-group double-free (related to CVE-2026-25589), affects Redis versions 6.2.22, 7.4.9, and 8.6.4. This flaw resides in the shared-NACK path of stream consumer groups, where the same heap chunk can be freed twice, providing an authenticated attacker with a reliable primitive to achieve code execution. While an incomplete fix for this issue was applied in version 8.8.0, a separate heap overflow vulnerability in the RedisBloom TDigest module, bundled by default with 8.8.0, still allows for RCE on a fresh instance.
Exploitation of these vulnerabilities requires specific commands that are often left enabled in internal Redis deployments, such as EVAL, RESTORE, and XGROUP. Attackers who gain access to compromised Redis credentials, potentially through secret leaks, SSRF attacks, or misconfigured network access controls, can leverage these flaws to escalate from data store access to gaining a host-level shell. Crucially, the exploitation can be performed without crashing the Redis service, potentially evading immediate detection.
The research highlights that while the stream NACK double-free was addressed in Redis 8.8.0, older maintained versions remain vulnerable if operators have not applied equivalent patches. Furthermore, version 8.8.0 is not entirely secure due to the separate TDigest heap overflow vulnerability in the RedisBloom module. The TDigest exploit's success is particularly high on fresh instances with minimal concurrent traffic, as it relies on carefully manipulating memory layouts (jemalloc) to achieve a deterministic outcome.
Defenders are urged to take several immediate actions. Firstly, upgrade to fixed Redis builds as soon as they become available, and do not assume version 8.8.0 is safe if the RedisBloom module remains vulnerable. Secondly, restrict the use of dangerous commands like EVAL and RESTORE through Redis ACLs or the rename-command configuration directive. Network isolation is paramount; Redis instances should never be exposed directly to the internet and should be bound to private interfaces only.
Additionally, organizations must enforce strong authentication practices, using unique passwords for Redis instances and rotating them regularly, especially after any suspected credential compromise. Auditing installed Redis modules and disabling or unloading unused ones, such as RedisBloom/TDigest, is also recommended. Monitoring for anomalous usage of commands like XGROUP, RESTORE, and EVAL, as well as unexpected files within Redis data directories, can help detect post-exploitation activities.
The discovery by the Kimi K3 AI agent underscores a growing trend in cybersecurity: AI-assisted vulnerability discovery is rapidly advancing. Core infrastructure components like Redis, which are foundational to many applications and services, remain high-value targets for attackers. The existence of authenticated RCE vulnerabilities, particularly those stemming from incomplete fixes and bundled modules, demonstrates that relying solely on password protection is insufficient for securing these critical systems.
Organizations utilizing Redis versions 6.2 through 8.8 are advised to inventory their Redis deployments, rigorously lockdown command surfaces, and closely monitor official advisories from Redis and RedisBloom for the release and application of complete security patches. The findings serve as a stark reminder that even seemingly secure internal systems can harbor critical vulnerabilities exploitable by sophisticated threat actors.