Kimi K3 Agents Found Redis Zero-Days and Built RCE Exploit, Researchers Say

Researchers have discovered that Kimi K3 agents found zero-day vulnerabilities in Redis and developed a remote code execution exploit. Redis has since released seven security updates to address the issues. The vulnerabilities can be exploited using authenticated remote code execution proof-of-concepts in certain versions of Redis. The exploit chains require specific features such as RESTORE, EVAL, and XGROUP, as well as the RedisBloom module in some cases. The vulnerabilities are related to memory flaws that could lead to remote code execution. Redis has released updated versions, including 6.2.23, 7.2.15, and 7.4.10, to fix the issues.