← what I check

Scan a host you own → Fix card Census

Why it matters

A RedisInsight or Redis Commander console is reachable without login. From there anyone can browse (and often change) keys in the Redis instances it manages — sessions, caches, and agent memory / tool state that RAG and agent stacks commonly park in Redis (OWASP ASI06). We detect the HTTP console, not the raw Redis wire protocol.

How common is it?

1,922 Redis instances are reachable in the Shodan index. Fingerprint match, not a verified zero-auth count · src: Shodan count · `http.title:"RedisInsight","Redis Commander"` · 2026-08

Counts are population-level, from third-party indexes and my own honeypots. I never scan the internet and this page makes no claim about any specific host.

Fix it

The full walkthrough lives on the fix card, kept current in one place:

Full fix card: redis-exposed →