CVE-2026-107911

Summary

A type confusion vulnerability in FalkorDB's command dispatcher allows authenticated attackers to cause memory corruption and denial of service by exploiting improper casting of Bolt client structures. This flaw can lead to remote code execution or data compromise.

Exploitability

Exploitation requires an authenticated user with GRAPH.QUERY privileges, making it moderately difficult but possible with a compromised account or weak access controls.

Blast radius

The vulnerability affects default configurations since the Bolt endpoint is enabled by default, potentially impacting all authenticated users of FalkorDB installations.

Detection

Monitor for unusual memory access patterns or segmentation faults in FalkorDB processes, particularly when processing GRAPH.QUERY commands with --bolt arguments, though no specific log indicators are mentioned in the description.

Prioritized remediation

Upgrade to FalkorDB 4.20.0 or later to remediate this type confusion vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.