← fix library

CRITICAL

Redis management console exposed to the internet

Why it matters

A RedisInsight or Redis Commander console is reachable without login. From there anyone can browse (and often change) keys in the Redis instances it manages — sessions, caches, and agent memory / tool state that RAG and agent stacks commonly park in Redis (OWASP ASI06). We detect the HTTP console, not the raw Redis wire protocol.

Fix it — 3 steps

1. Turn on console auth (RedisInsight login / Redis Commander HTTP auth) or put the UI behind an authenticating reverse proxy / SSO.
2. If only operators need it, unpublish the port: bind 127.0.0.1 or firewall 5540/8001/8081 (sudo ufw deny 5540).
3. Require AUTH (or ACLs) on every Redis instance the console can reach, and rotate credentials if the console sat open.

Verify it’s fixed

curl -m 5 http://YOUR_SERVER_IP:5540/api/databases  # should return 401/403 or be unreachable — not a JSON database list

References

• https://redis.io/docs/latest/operate/redisinsight/
• https://redis.io/docs/latest/operate/oss_and_stack/management/security/acl/
• https://genai.owasp.org/2025/12/09/owasp-top-10-for-agentic-applications-the-benchmark-for-agentic-security-in-the-age-of-autonomous-ai/