CVE-2026-23631

A flaw was found in Redis, an in-memory data structure store. An authenticated attacker can exploit a use-after-free vulnerability in redis-server with Lua scripting. This occurs through the master-replica synchronization mechanism on replicas where replica-read-only is disabled or can be disabled. Successful exploitation may lead to remote code execution.

This Important vulnerability in Redis affects instances configured with Lua scripting and operating as replicas where the replica-read-only setting is disabled or can be modified by an authenticated attacker. Exploitation of a use-after-free flaw during master-replica synchronization could lead to remote code execution. The risk is present in deployments where Redis replicas are configured for write operations or lack sufficient access controls to prevent modification of the replica-read-only setting.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this flaw, ensure that Redis replicas maintain replica-read-only as enabled and prevent its modification by unauthorized users. If Lua scripting is not a required feature, consider disabling it to reduce the attack surface. Restricting network access to Redis instances to trusted clients can also limit exposure. For Redis configuration, edit the redis.conf file to include or verify: replica-read-only yes After modifying the configuration, restart the Redis service for the changes to take effect. This action will temporarily interrupt service availability.