FalkorDB EUVD-2026-95487

Two concrete conditions must both hold. First, the operator must have explicitly enabled the Bolt endpoint by setting BOLT_PORT, which is disabled by default - so default FalkorDB installations are not exposed. Second, the bypass only triggers when the backing Redis returns an error OTHER than WRONGPASS to the empty AUTH probe, specifically LOADING (while a dataset is being loaded), MASTERDOWN (during replication failover), or OOM (under memory pressure); in steady-state operation with a password set, the empty AUTH returns WRONGPASS and authentication is correctly enforced. These transient-state and non-default-configuration requirements (captured as AT:P in the CVSS 4.0 vector) substantially limit realistic exploitation despite the lack of required authentication or user interaction.

The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H) scores 9.2 Critical and reflects a genuine authentication bypass reachable by a remote unauthenticated attacker over the network with high confidentiality, integrity, and availability impact on the vulnerable system. The single most important real-risk moderator is the AT:P (attack requirement present) metric: exploitation is NOT reliable on demand, because the bypass only occurs when Redis returns a non-WRONGPASS error (LOADING during dataset load, MASTERDOWN during replication failover, or OOM under memory pressure) to the empty AUTH probe - a transient server state the attacker typically cannot summon at will. A second strong moderator is deployment: the Bolt endpoint (BOLT_PORT) is disabled by default, so only operators who have explicitly enabled it are exposed. No EPSS score was provided and the vulnerability is NOT in CISA KEV; no POC or SSVC decision data was supplied. Net assessment: a legitimately critical auth-bypass flaw in design, but real-world exploitation is gated by a non-default configuration AND a transient error window, which lowers the practical priority below what the raw 9.2 suggests - treat as high-priority patching for anyone running the Bolt endpoint, lower urgency otherwise. No exploitation-probability (EPSS) signal was available to confirm or contradict this.

An attacker reaches the exposed Bolt port of a FalkorDB instance that has BOLT_PORT enabled, and connects while the server is momentarily in a LOADING, MASTERDOWN, or OOM state - for example right after a restart/dataset load or during a failover. Because FalkorDB's is_authenticated check treats any non-WRONGPASS error on the empty AUTH probe as success, the attacker is admitted without credentials and issues arbitrary graph queries to read, modify, or destroy graph data. No public exploit identified at time of analysis.