PT-2026-108729
CVE-2026-107910
·
Published
2026-10-09
·
Updated
2026-10-09
Description by
CVSS 4.0
9.2
CriticalMetricsAV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions
FalkorDB versions prior to 4.20.0
Description
An improper authentication issue exists in the
is authenticated() function (src/bolt/bolt api.c). The function determines if a password is required by sending an empty AUTH command to Redis. It incorrectly treats only a WRONGPASS error as an indication that authentication is necessary. Other errors, such as LOADING (occurring during dataset loading), MASTERDOWN (occurring during replication failover), or OOM (Out of Memory), result in the client being treated as authenticated. This allows a remote unauthenticated attacker to execute graph queries without credentials via the Bolt endpoint. This issue only affects deployments where the Bolt endpoint is enabled via BOLT PORT.Recommendations
Update to version 4.20.0 or later.
Disable the
BOLT PORT configuration to deactivate the Bolt endpoint if it is not required. Found an issue in the description? Have something to add? Feel free to write us 👾