Quick answers
- Is CVE-2026-107910 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-107910 being exploited in the wild.
- How severe is CVE-2026-107910?
- High severity, with a CVSS score of 8.1, published 9 October 2026.
- Which products and versions are affected?
- FalkorDB before 4.20.0.
- Is there a fix for CVE-2026-107910?
- Yes: fixed in 4.20.0. Until then: Disable the Bolt endpoint by not setting BOLT_PORT, or restrict network access to the Bolt port to trusted clients only. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-107910 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-107910?
- Check whether you run FalkorDB at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: 4.20.0
Disable the Bolt endpoint by not setting BOLT_PORT, or restrict network access to the Bolt port to trusted clients only.
Technical details
The is_authenticated function in src/bolt/bolt_api.c incorrectly handles AUTH command responses, treating only WRONGPASS errors as proof that authentication is required. Other Redis errors (LOADING, MASTERDOWN, OOM) incorrectly allow clients to proceed authenticated. This authentication bypass affects only FalkorDB deployments with the Bolt endpoint explicitly enabled (disabled by default) and requires network access to that endpoint.
Affected products
- FalkorDB FalkorDB before 4.20.0
Timeline
- 2026-10-09: disclosed