Which versions of Queryweaver are affected by CVE-2026-10130?

FalkorDB QueryWeaver is vulnerable to an unauthenticated account takeover affecting any user account in the system.. A patch is available.

How to fix or mitigate CVE-2026-10130?

Within 24 hours: Retrieve the vendor-released patch for FalkorDB QueryWeaver and create an inventory of all affected instances across production, staging, and development. Within 7 days: Apply the patch to all FalkorDB QueryWeaver deployments and conduct authentication testing to confirm the bypass is remediated. Within 30 days: Review logs for exploitation attempts during the vulnerability window, complete post-patch validation testing, and document lessons learned regarding authentication architecture review.

Queryweaver CVE-2026-10130

Q: What is the CVSS score of CVE-2026-10130?

CVE-2026-10130 has a CVSS 4.0 base score of 8.8 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-45405 HIGH

Incorrect Authorization (CWE-863)

2026-07-18 VulnCheck

GHSA-hxxv-mxpg-3h6j

Authentication Bypass Queryweaver

8.8

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.8 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.1 CRITICAL

Remote, low-complexity, unauthenticated, no interaction; issuing a victim session token enables full account read and modification, so C:H and I:H, with no availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Jul 18, 2026 - 23:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 18, 2026 - 23:22 vuln.today

cvss_changed

CVSS changed

Jul 18, 2026 - 23:22 NVD

8.2 (HIGH) 8.8 (HIGH)

Analysis Generated

Jul 18, 2026 - 22:45 vuln.today

CVE Published

Jul 18, 2026 - 22:15 cve.org

HIGH 8.2

DescriptionCVE.org

QueryWeaver contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid session tokens for existing accounts by submitting a signup request with a known victim email address. The signup route unconditionally creates and links a new token to the matching Identity via a Cypher MERGE operation before checking whether the email belongs to an existing account, causing the server to return a valid authenticated session token for the victim's identity without requiring any prior credentials or user interaction.

AnalysisAI

Authentication bypass in FalkorDB QueryWeaver lets unauthenticated attackers hijack any existing account by submitting a signup request containing the victim's email address, whereupon the server issues a valid session token bound to the victim's identity. No credentials, prior access, or user interaction are required, making this a pre-auth account takeover. No public exploit identified at time of analysis, though the flaw was reported by VulnCheck and a vendor patch is available.