CVE-2026-107910

Summary

A remote attacker can bypass authentication on FalkorDB's Bolt endpoint by exploiting a flawed authentication check that incorrectly treats Redis errors like LOADING or MASTERDOWN as successful authentications, allowing unauthorized graph query execution.

Exploitability

Exploitation is straightforward for remote attackers with access to the Bolt endpoint, requiring only a connection to the service and execution of graph queries without providing credentials, with no additional preconditions.

Blast radius

The vulnerability affects deployments that have enabled the Bolt endpoint (BOLT_PORT), which is disabled by default, potentially limiting widespread impact but still affecting any exposed FalkorDB instance with this feature enabled.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to FalkorDB 4.20.0 or later to fix the authentication flaw in the is_authenticated function.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.