Redis Use-After-Free in unblockClientOnKey Leading to Authenticated RCE

CVE-2026-23479 is a use-after-free in Redis's unblockClientOnKey() function in src/blocked.c. When a blocked client (e.g., one waiting on XREAD BLOCK) is evicted due to maxmemory-clients pressure during command re-execution, processCommandAndResetClient() frees the client structure — but the caller never checks the return value indicating the client was freed, and proceeds to access the dangling pointer. An authenticated attacker with @admin + @scripting + @stream + @read/@write ACL permissions can groom the heap, reclaim the freed allocation with a crafted fake client structure, and ultimately achieve arbitrary command execution as the redis-server process. All Redis versions from 7.2.0 through 8.6.2 are affected across the 7.2.x, 7.4.x, 8.2.x, 8.4.x, and 8.6.x branches. Fixed versions shipped May 5, 2026: 7.2.14, 7.4.9, 8.2.6, 8.4.3, 8.6.3, plus a backport to 6.2.22. Redis Software (enterprise) is fixed in 8.0.10-64, 7.22.2-79, 7.8.6-253, 7.4.6-279, 7.2.4-153.

The NVD assigned CVSS 3.1 8.8 with AC:L, implying this is trivially exploitable by any low-privileged user. That overstates reality. Red Hat independently rescored to 7.5 with AC:H, noting *'a highly specific sequence of events and time-dependent conditions that are not directly in control of an attacker must occur.'* Redis's own GHSA uses CVSS 4.0 and arrived at 7.7. Both of those are closer to the truth. The chain is real — a weaponized Python PoC from v12-security achieves full RCE even under full RELRO — but it requires authenticated access with admin-class permissions, heap grooming across multiple stages, and precise timing of the eviction race. In default configurations without ACLs, the default user has every permission needed, which keeps the floor firmly at HIGH. But calling this AC:L misrepresents the exploitation engineering involved.

Sources.

1. Redis Official Security Advisory
2. GitHub Security Advisory GHSA-93m2-935m-8rj3
3. Red Hat CVE Page — CVE-2026-23479
4. ZeroDay.cloud Deep Dive
5. v12-security PoC Repository
6. Debian Security Tracker
7. Censys — Exposed Redis Instances
8. Security Boulevard Analysis

Run this script on each host running Redis, or from an auditor workstation with redis-cli installed and network access to the target. Invoke as: bash check_cve_2026_23479.sh <redis-host> <redis-port> [redis-password]. No elevated privileges required — uses redis-cli INFO server to read the version.

#!/usr/bin/env bash
# check_cve_2026_23479.sh — Detect CVE-2026-23479 (Redis UAF in unblockClientOnKey)
# Usage: bash check_cve_2026_23479.sh <host> <port> [password]
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -euo pipefail

HOST="${1:-127.0.0.1}"
PORT="${2:-6379}"
PASS="${3:-}"

AUTH_ARGS=()
if [[ -n "$PASS" ]]; then
  AUTH_ARGS=(-a "$PASS" --no-auth-warning)
fi

# Fetch redis version
VERSION=$(redis-cli -h "$HOST" -p "$PORT" "${AUTH_ARGS[@]}" INFO server 2>/dev/null \
  | grep -E '^redis_version:' | cut -d: -f2 | tr -d '\r')

if [[ -z "$VERSION" ]]; then
  echo "UNKNOWN — could not connect to Redis at $HOST:$PORT or parse version."
  exit 2
fi

echo "Detected Redis version: $VERSION"

# Parse major.minor.patch
IFS='.' read -r MAJOR MINOR PATCH <<< "$VERSION"

# Versions < 7.2.0 are NOT affected (vulnerable code introduced in 7.2.0)
if (( MAJOR < 7 )) || { (( MAJOR == 7 )) && (( MINOR < 2 )); }; then
  echo "PATCHED — Redis $VERSION predates the vulnerable code (introduced in 7.2.0)."
  exit 0
fi

# Check each affected branch against its fixed version
VULN=0
if (( MAJOR == 7 && MINOR == 2 )); then
  (( PATCH < 14 )) && VULN=1
elif (( MAJOR == 7 && MINOR == 4 )); then
  (( PATCH < 9 )) && VULN=1
elif (( MAJOR == 8 && MINOR == 2 )); then
  (( PATCH < 6 )) && VULN=1
elif (( MAJOR == 8 && MINOR == 4 )); then
  (( PATCH < 3 )) && VULN=1
elif (( MAJOR == 8 && MINOR == 6 )); then
  (( PATCH < 3 )) && VULN=1
elif (( MAJOR >= 9 )); then
  # Future major version — assume patched
  VULN=0
else
  # Other 7.x or 8.x minor branches (e.g., 7.3, 8.0, 8.1) —
  # likely affected if >= 7.2 but not in a known-fixed branch.
  echo "UNKNOWN — Redis $VERSION is on an unrecognized branch. Check vendor advisory."
  exit 2
fi

if (( VULN == 1 )); then
  echo "VULNERABLE — Redis $VERSION is affected by CVE-2026-23479."
  echo "Upgrade to the fixed version for your branch (7.2.14 / 7.4.9 / 8.2.6 / 8.4.3 / 8.6.3)."
  exit 1
else
  echo "PATCHED — Redis $VERSION includes the fix for CVE-2026-23479."
  exit 0
fi