FalkorDB Bolt Endpoint Auth Bypass Lets Attackers Run Queries Without Credentials

A critical authentication bypass vulnerability in FalkorDB allows remote, unauthenticated attackers to execute arbitrary graph queries without providing credentials. The flaw, tracked as CVE-2026-107910, affects all versions of the graph database engine prior to 4.20.0 and has been assigned a CVSS score of 9.2, indicating a critical severity level.

The vulnerability stems from improper logic within the `is_authenticated` function located in `src/bolt/bolt_api.c`. When a client connects via the Bolt endpoint, the function attempts to determine if a password is required by sending an empty AUTH command to the underlying Redis instance. The code incorrectly interprets the response: it treats only a WRONGPASS error as an indication that authentication is necessary.

If Redis returns any other type of error, the system erroneously assumes the client is already authenticated. This behavior allows an attacker to bypass authentication entirely if the Redis backend is in a state that generates errors such as LOADING (during dataset loading), MASTERDOWN (during replication failover), or OOM (out-of-memory conditions).

Technical Context and Scope

The National Vulnerability Database (NVD) classifies the weakness under CWE-287 (Improper Authentication). The exploitability of this issue is contingent upon the configuration of the FalkorDB instance. The Bolt endpoint, which exposes this vulnerability, is disabled by default in FalkorDB installations. Consequently, only organizations that have explicitly enabled the Bolt port via the `BOLT_PORT` configuration parameter are exposed to this risk.

According to the NVD record, the flaw allows an attacker to interact with the database without valid credentials, potentially leading to unauthorized data access or manipulation. The specific error conditions that trigger the bypass—such as memory pressure or replication issues—may occur intermittently or under load, creating a window of opportunity for exploitation even if the system is generally stable.

Affected Systems

This vulnerability impacts FalkorDB versions prior to 4.20.0. FalkorDB is an open-source graph database that utilizes Redis as its storage engine. While the Bolt protocol is a standard for connecting to graph databases, FalkorDB’s implementation of authentication checks for this protocol contains the defective logic described above. Users running older versions with the Bolt interface active must assume their instances are vulnerable to unauthenticated query execution.

What should you do?

Security teams should immediately audit their FalkorDB deployments to determine if the Bolt endpoint is enabled. If the `BOLT_PORT` is active, administrators should restrict network access to the port, ensuring it is not exposed to untrusted networks or the public internet. Organizations should prioritize upgrading to FalkorDB 4.20.0 or later, as the source material indicates this is the version that resolves the issue. Until an upgrade is possible, monitoring for unusual query activity or unexpected error states in the underlying Redis logs may help detect exploitation attempts.