[theplumber]

Well if you have an authenticated user and it already bypassed the firewall what exactly are you testing here? These kind of “zero days” pretty pointless. Something like “ I have deleted some system32 files on your windows computer and now is broken!” Even I am already an admin user on the machine.

[pizza234]

No, that’s a flawed analogy, because this is an RCE. It's (like) having credentials for a network service, then exploiting that service to execute arbitrary code on the Windows host (of course the blast radius depends on the underlying permissions). Access to Redis is not access to the underlying server.

[theplumber]

You are right but running Redis or any database without a firewall in 2026 is already a quite bad posture. Now with credentials as well that’s pretty much as bad as it can be.

>> Access to Redis is not access to the underlying server.

Then you should make sure you run it with the right privilege and consider it potential rogue so when it gets hacked you don’t have to worry about the blast radius because it’s contained it redis privileges.

If you are in this kind of bug hunting then try Wordpress with credentials and see how far you can go. I am sure you can find several such bugs with or without any AI.

[pizza234]

A firewall can reduce who gets an opportunity to exploit this, but does not make an authenticated RCE irrelevant. This access pattern is perfectly legitimate for hosted Redis services, for example.

[gregoriol]

The reason this is interesting is that it allows to go further into the target system if you already have a frontend vulnerability