{"id":"CVE-2026-107910","published":"2026-10-09T06:17:12.457","lastModified":"2026-10-09T06:17:12.577","description":"An improper authentication vulnerability in the is_authenticated function (src/bolt/bolt_api.c) in FalkorDB before 4.20.0 allows a remote unauthenticated attacker to execute graph queries without credentials through the Bolt endpoint. The function decides whether a password is required by issuing an empty AUTH command to Redis and treats only a WRONGPASS error as meaning that a password is required; any other error, such as LOADING while a dataset is being loaded, MASTERDOWN during replication failover, or OOM under memory pressure, causes the client to be treated as authenticated. Only deployments that enable the Bolt endpoint (BOLT_PORT, disabled by default) are affected.","cvssScore":8.1,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-287"],"vendors":[],"products":[],"references":[{"url":"https://github.com/FalkorDB/FalkorDB/commit/0b11a00b34b25c4d4fdfe55f0a35c8a00593bd7d","tags":[]},{"url":"https://github.com/FalkorDB/FalkorDB/pull/2170","tags":[]},{"url":"https://github.com/FalkorDB/FalkorDB/releases/tag/v4.20.0","tags":[]}],"exploitRefs":[{"url":"https://github.com/FalkorDB/FalkorDB/commit/0b11a00b34b25c4d4fdfe55f0a35c8a00593bd7d","tags":[]},{"url":"https://github.com/FalkorDB/FalkorDB/pull/2170","tags":[]},{"url":"https://github.com/FalkorDB/FalkorDB/releases/tag/v4.20.0","tags":[]}],"hasPoc":true,"ai":{"summary":"A remote attacker can bypass authentication on FalkorDB's Bolt endpoint by exploiting a flawed authentication check that incorrectly treats Redis errors like LOADING or MASTERDOWN as successful authentications, allowing unauthorized graph query execution.","exploitability":"Exploitation is straightforward for remote attackers with access to the Bolt endpoint, requiring only a connection to the service and execution of graph queries without providing credentials, with no additional preconditions.","blast_radius":"The vulnerability affects deployments that have enabled the Bolt endpoint (BOLT_PORT), which is disabled by default, potentially limiting widespread impact but still affecting any exposed FalkorDB instance with this feature enabled.","remediation":"Upgrade to FalkorDB 4.20.0 or later to fix the authentication flaw in the is_authenticated function.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["auth-bypass","bolt","database"],"model":"garnet-coder","analyzedAt":"2026-10-16T09:18:07.820Z"}}