What this actually is.
Technical background, root cause, and affected surface.
An authentication bypass in is_authenticated (src/bolt/bolt_api.c) in FalkorDB before 4.20.0 allows a remote unauthenticated attacker to execute Cypher queries without credentials. The function decides whether a password is required by sending AUTH "" to Redis and treating only a WRONGPASS error as 'password required'; any other error (for example -LOADING during RDB load, -MASTERDOWN during failover, or -OOM under memory pressure) fails open and the client is treated as authenticated. Bolt is disabled by default (BOLT_PORT=-1); only deployments that set BOLT_PORT are exposed.
- Vendor
- FalkorDB
- Product
- FalkorDB
- Severity
- High
- CVSS Score
- 8.1
- Status
- Fixed (v4.20.0)
- Vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- CWE
- CWE-287
From one request
to root shell.
Reproduced in a sandboxed environment. Requires only LAN or WiFi adjacency.
The bug, and the fix.
// src/bolt/bolt_api.c:62-88 (identical in master 835d06e): static bool is_authenticated(...) { uint32_t auth_size = bolt_read_map_size(&client->msg_buf.read); if(auth_size < 3) { RedisModuleCallReply *reply = RedisModule_Call(client->ctx, "AUTH", "c", ""); ... const char *err = RedisModule_CallReplyStringPtr(reply, &err_len); bool password_required = (err_len >= 9 && memcmp(err, "WRONGPASS", 9) == 0); return !password_required; // any non-WRONGPASS error → AUTHENTICATED } ... }
What an attacker does to you.
Post-exploitation outcomes mapped to CVSS impact metrics.
Full bypass of requirepass/ACL enforcement for Bolt clients during the trigger windows (post-restart RDB load, replication failover, memory pressure): the attacker can read and modify graph data. Requires the Bolt endpoint to be enabled and the attacker to connect during a trigger window (AC:H). The bypass follows deterministically from the code; it was not exercised against a live LOADING window.
C:H · I:H · A:H
CWE-287
Fix it. In this order.
A runbook, not a checklist. Sequence matters — assume compromise before you act.
Upgrade FalkorDB to 4.20.0 or later, where the Bolt subsystem has been removed (PR #2170), or move to 6.x. Interim for older versions: leave BOLT_PORT unset (default) or restrict the Bolt port to trusted networks.
disclose@securin.ioVendors moved in days.
Attackers in hours.
Reconstructed from vendor advisories, CISA bulletins, and Securin research records.
Source-level audit of FalkorDB v4.18.10; re-verified against upstream master 835d06e on 2026-06-24 (2026-04 to 2026-06-29)
Reported to FalkorDB security team (security@falkordb.com) as part of a 6-finding disclosure pack; vendor acknowledged receipt the same day
Vendor removed the Bolt subsystem (PR #2170, commit 0b11a00) - no advisory or credit
FalkorDB 4.20.0 released without Bolt support
90-day coordinated disclosure window ended with no further vendor response
FalkorDB 6.0.0 released (Rust engine; C code base not present)
Securin re-verified: Bolt code absent from 4.20.0, 4.20.7, 4.22.0 and 6.0.2 | CVE-2026-107910 assigned by Securin CNA
CVE-2026-107910 published to the CVE List by Securin CNA (NVD import pending)
Disclosed 9 days after discovery
Cite, verify, go deeper.
Primary sources — NVD, CISA KEV, and machine-readable IoC feed.