CVE-2026-23631: 
Redis vulnerability analysis and mitigation

CVE-2026-23631 is a use-after-free vulnerability in Redis's Lua scripting subsystem, dubbed "DarkReplica," that allows an authenticated attacker to exploit the master-replica synchronization mechanism to potentially achieve remote code execution on replica nodes. It affects all versions of redis-server with Lua scripting (>= 7.0.0) where replica-read-only is disabled or can be disabled, and is patched in Redis 8.6.3. The vulnerability was reported by independent researcher Yoni Sherez and identified during the Wiz Zeroday Cloud event, with public disclosure on May 5, 2026. It carries a CVSS v3.1 score of 8.1 (High) and a CVSS v4.0 score of 6.1 (Medium) (GitHub Advisory, Redis Release).

The root cause is a use-after-free condition (CWE-416) in Redis's Lua scripting engine, triggered through the master-replica synchronization mechanism. When replica-read-only is disabled on a replica, an authenticated attacker can craft Lua script execution in a way that causes memory to be freed and subsequently referenced, leading to memory corruption. The attack vector is network-based and requires low privileges (authenticated access), but no user interaction, and the attack complexity is rated High under CVSSv4, reflecting the need to manipulate the replication state. The vulnerability was publicly named "DarkReplica" and detailed in a technical write-up by Zeroday Cloud, with a PoC repository also appearing on GitHub (GitHub Advisory, Zeroday Cloud).

Successful exploitation can lead to remote code execution on affected Redis replica instances, allowing an attacker to compromise the integrity and availability of the replica server. The confidentiality impact is rated None (no direct data exfiltration via the vulnerability itself), but integrity and availability are both rated High — an attacker could corrupt data, crash the replica, or execute arbitrary commands in the context of the Redis process. In environments where Redis replicas serve as read-scale infrastructure or caching layers, exploitation could disrupt dependent applications and potentially enable lateral movement within the internal network (GitHub Advisory, GBHackers).

1. Reconnaissance: Identify Redis instances with replication enabled using network scanning tools (e.g., Shodan, Censys, or nmap targeting port 6379). Determine if the target is a replica with replica-read-only set to no by connecting and issuing CONFIG GET replica-read-only.
2. Authentication: Obtain valid Redis credentials (e.g., via credential stuffing, leaked configuration files, or default/weak passwords) and authenticate using AUTH <password>.
3. Verify replica-read-only status: Confirm the replica allows writes by checking CONFIG GET replica-read-only returns no, or attempt to disable it via CONFIG SET replica-read-only no if the authenticated user has sufficient privileges.
4. Trigger use-after-free via Lua scripting: Craft and execute a Lua script using the EVAL command that interacts with the master-replica synchronization mechanism in a way that causes a use-after-free condition in the Lua scripting engine on the replica.
5. Achieve code execution: Leverage the memory corruption to redirect execution flow and execute arbitrary commands in the context of the Redis server process, potentially establishing a reverse shell or deploying a persistent backdoor (GitHub Advisory, Zeroday Cloud).

• Network: Unexpected authenticated connections to Redis replica instances (port 6379/TCP) from unusual source IPs; outbound connections from the Redis server process to external IPs following Lua script execution.
• Logs: Redis logs showing EVAL or EVALSHA commands executed by non-administrative users on replica nodes; CONFIG SET replica-read-only no commands in Redis command logs; crash or segfault entries in Redis logs (redis.log) indicating memory corruption.
• Process: Unexpected child processes spawned by the Redis server process (e.g., /bin/sh, bash, curl, wget); unusual memory usage spikes in the Redis process.
• File System: New or modified files in the Redis working directory or system directories created by the Redis process user; unexpected cron jobs or startup scripts added under the Redis service account (Zeroday Cloud, GitHub Advisory).

The primary remediation is to upgrade Redis to version 8.6.3 or later, which contains the security fix for CVE-2026-23631 (Redis Release). For environments that cannot immediately patch, two workarounds are available: (1) disable Lua scripting access for untrusted users using Redis ACLs (e.g., deny the EVAL, EVALSHA, and SCRIPT commands), or (2) ensure all replica instances have replica-read-only yes set in their configuration and prevent users from changing this setting via CONFIG SET. Valkey (the Redis fork) also released patched versions (8.0.8, 9.1.0) addressing this issue (GitHub Advisory, Redis Advisory).

Redis published an official security advisory blog post covering CVE-2026-23631 alongside four other CVEs patched in the 8.6.3 release, emphasizing the security urgency of the update (Redis Advisory). The Canadian Centre for Cyber Security (CCCS) and HKCERT both issued advisories urging users to patch (CCCS Advisory). Security media outlets including GBHackers, CyberSecurityNews, and SecureBulletin covered the vulnerability cluster, highlighting the RCE potential and the "DarkReplica" naming. The Zeroday Cloud blog published a detailed technical breakdown of the vulnerability mechanics, and the oss-security mailing list also carried a disclosure post (Zeroday Cloud, oss-sec).