A login gate does not help much when the default Redis user already has the rights the exploit needs. In cloud deployments that leave Redis on the default account or without a password, an authenticated use-after-free becomes practical internet-scale risk instead of a bounded bug.
The flaw is CVE-2026-23479 in Redis 7.2.0-era code. A public technical write-up says it was introduced in Redis 7.2.0, patched on May 5, and affects Redis deployments where the default user is highly privileged; Wiz says Redis appears in a large share of cloud environments, and most of those instances run without a password.
The broken assumption is that “authenticated” means safely contained by access control. Here, the deployment model supplies the access for the attacker, so patch status and account hygiene both matter for exposure.