New Kimi K3 AI Agent Uncovers 0-Day Exploits in Redis Server

A newly reported research effort tied to the Kimi K3 AI agent has surfaced multiple authenticated remote code execution (RCE) paths in Redis, one of the world’s most widely deployed in-memory data stores.

The findings shared by researcher alias Bera Buddies cover the stock builds of Redis 6.2.22, 7.4.9, 8.6.4, and 8.8.0, combining a stream consumer-group shared-NACK double-free issue with a separate heap overflow in the bundled RedisBloom TDigest module.

Kimi K3 AI Agent Uncovers 0-Day

Researchers describe non-destructive RCE against official Redis Docker images. Two distinct bug classes are involved:

• Stream NACK double-free (CVE-2026-25589 incomplete-fix family) — Affects 6.2.22, 7.4.9, and 8.6.4. The shared-NACK path in stream consumer groups can free the same heap chunk twice, giving an authenticated client a reliable primitive for code execution.
• TDigest heap overflow (RedisBloom, bundled in 8.8.0) — On Redis 8.8.0, the NACK issue is addressed (PR #15081), but a newly identified heap overflow in the default TDigest implementation still enables RCE on a fresh instance.

Both paths require commands commonly left enabled in internal deployments: EVAL, RESTORE, and XGROUP. Version 8.8.0 also needs the bundled RedisBloom module, which ships by default.

Redis often sits behind application tiers with a password but full command surface. Once an attacker obtains credentials—via a secret leak, SSRF, or misconfigured network ACL they can move from “data store access” to a host-level shell without crashing the service in a way that always looks like an attack.

The research highlights that the shared-NACK double-free was only fully fixed in 8.8.0. Older maintained lines remain exposed if operators have not applied equivalent patches. Meanwhile, 8.8.0 is not automatically safe: the TDigest bug is described as unfixed in the bundled module at the time of disclosure.

Layout sensitivity on 8.8.0 is notable. The TDigest path relies on spraying structures to build a deterministic jemalloc layout, so success is highest on a fresh instance with minimal concurrent traffic conditions that still match many lab, CI, and lightly loaded production pods.

Affected Versions at a Glance

Post-exploitation residue may leave inert keys or corrupted structures. Operators are warned not to run FLUSHALL/SAVE blindly on a compromised 8.8.0 host without understanding the leftover state.

Takeaway for Defenders

Until vendor patches cover every branch and the RedisBloom module:

1. Upgrade to fixed Redis builds as soon as they are published; do not assume 8.8.0 is fully safe if Bloom/TDigest remains vulnerable.
2. Restrict dangerous commands with rename-command for EVAL, RESTORE, and related admin primitives, or use Redis ACLs to deny them for app users.
3. Network isolation — bind Redis to private interfaces; never expose 6379 to the internet.
4. Strong auth and secret hygiene — unique passwords, no default creds, rotate after any suspected leak.
5. Module audit — disable or unload RedisBloom/TDigest if unused.
6. Monitor for anomalous XGROUP/RESTORE/EVAL usage and unexpected keys under data directories.

The Kimi K3–linked research underscores a hard lesson for 2026: AI-assisted vulnerability discovery is accelerating, and core infrastructure like Redis remains a high-value target. Authenticated RCE via incomplete fixes and bundled modules means “we set a password” is not a complete security strategy.

Organizations running Redis 6.2–8.8 should inventory versions, lock down command surfaces, and track official Redis and RedisBloom advisories for complete fixes.

The Privilege Paths Attackers See That You Don’t: BeyondTrust Pathfinder Platform Does It for You -> Get Free Identity Security Assessment