CVE-2026-107910: Authentication bypass in FalkorDB Bolt endpoint via fail-open AUTH probe error handling
An improper authentication vulnerability in the isauthenticated function (src/bolt/boltapi.c) in FalkorDB before 4.20.0 allows a remote unauthenticated attacker to execute graph queries without credentials through the Bolt endpoint. The function decides whether a password is required by issuing an empty AUTH command to Redis and treats only a WRONGPASS error as meaning that a password is required; any other error, such as LOADING while a dataset is being loaded, MASTERDOWN during replication failover, or OOM under memory pressure, causes the client to be treated as authenticated. Only deployments that enable the Bolt endpoint (BOLTPORT, disabled by default) are affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FalkorDBto a version that resolves this vulnerability.Fixed in 4.20.0
Event History
Frequently Asked Questions
Which deployments are exposed?
Only FalkorDB deployments with the Bolt endpoint enabled through BOLT_PORT are affected. BOLT_PORT is disabled by default.
What conditions does an attacker need to exploit this issue?
A remote attacker does not need credentials or user interaction, but must be able to reach the Bolt endpoint while its authentication probe receives an error other than WRONGPASS. Examples include LOADING during dataset loading, MASTERDOWN during replication failover, or OOM under memory pressure.
What can an unauthenticated attacker do if exploitation succeeds?
The attacker can execute graph queries through the Bolt endpoint without credentials. The reported impact includes high confidentiality, integrity, and availability consequences.
How can exposure be reduced before upgrading?
Disable the Bolt endpoint by ensuring BOLT_PORT is not enabled, or prevent untrusted remote access to that endpoint. The affected behavior is fixed in FalkorDB 4.20.0.