RedisCVE Watchtower
An always-on agent that fingerprints every Redis instance in your fleet, alerts when any version matches a known RCE chain (including the new NACK-double-free and RedisBloom TDigest families), and ships a one-click, replication-aware upgrade playbook.
SRE and DevOps leads running Redis at small-to-mid SaaS companies
- Continuous version + module fingerprinting across K8s, VMs, and managed Redis with RBAC-aware auth
- CVE-to-version mapping auto-refreshed from NVD, GitHub advisories, and the upstream Redis security feed
- Safe rolling upgrade scripts that drain replicas and roll forward with rollback to a known-good tag
- PagerDuty/Slack alerts with a one-line exploit summary and the specific commands an attacker would run
Multiple critical Redis RCE PoCs covering 6.2.22 through 8.8.0 just hit GitHub Trending; ops teams need automated fleet inventory before mass scanning starts weaponizing the public exploits.
198-star trending PoC with active forks shows real defender pull to know their fleet exposure.GitHub - raminfp/redis_exploit: CVE-2025-49844 (RediShell) ↗
General vuln scanners exist but Redis-specific fleet watchers with upgrade automation are a thinner niche.GitHub - raminfp/redis_exploit: CVE-2025-49844 (RediShell) ↗
Security and infra teams have budget; $200–2k/mo per fleet is a normal line item.GitHub - raminfp/redis_exploit: CVE-2025-49844 (RediShell) ↗
CVE-specific urgency fades in months but the continuous 'is my Redis fleet exposed?' need is permanent.
Redis INFO parsing and version detection are trivial; traffic-draining upgrade orchestration is the harder piece.