TI-2026-69853 Aliases CVE-2026-107911

Type confusion in FalkorDB GRAPH.QUERY via the --bolt argument

LOW 36CWE-843Published 2026-10-09 · Updated 2026-10-09

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: High
Attack requirements: None
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-843 and the CVSS impact.

Summary

FalkorDB before 4.20.0 contains a type confusion flaw in the _read_flags function, which casts a Redis string argument to a Bolt client structure without checking its origin (CWE-843). A remote attacker with low privileges who is authenticated and can run GRAPH.QUERY can cause a denial of service and possibly disclose or corrupt memory. The --bolt argument is parsed even when the Bolt endpoint is disabled, so default configurations are affected.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

A type confusion vulnerability in the _read_flags function (src/commands/cmd_dispatcher.c) in FalkorDB before 4.20.0 allows a remote authenticated attacker who can run GRAPH.QUERY to cause a denial of service and possibly disclose or corrupt memory. The function accepts a --bolt argument from any client and casts the following command argument, a Redis string object, to a Bolt client structure without checking its origin; the result-set code then dereferences pointers read from that object. The argument is parsed even when the Bolt endpoint is disabled, so default configurations are affected.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00354 29th percentileScored 2026-11-07

Fix Fixed FalkorDB (FalkorDB): 4.20.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
FalkorDB	FalkorDB	before 4.20.0	4.20.0	Patch available	CNA

FalkorDB VendorFalkorDB Affected before 4.20.0 Fixed in 4.20.0 Patch available CNA

CPE names CNA · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:falkordb:falkordb::::::::	—	—	FalkorDB

cpe:2.3:a:falkordb:falkordb:*:*:*:*:*:*:*:* Versions — — ·FalkorDB

Remediation

Upgrade FalkorDB to version 4.20.0 or later, which is the fixed version.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Fix · CNA FalkorDB (FalkorDB) Fixed in 4.20.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2026-10-09
FalkorDB 4.20.0
4 records Highest priority Priority MEDIUM 3 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2026-69850 Heap out-of-bounds write in FalkorDB Bolt RESET handlerPriority MEDIUM 49
- TI-2026-69851 Out-of-bounds write in FalkorDB Bolt WebSocket frame handlingPriority MEDIUM 46
- TI-2026-69852 Authentication bypass in FalkorDB Bolt endpointPriority MEDIUM 42
Show all 4 records →

Timeline

2026-10-09 Threatist record created from CVE-2026-107911
2026-10-10 CISA SSVC decision points changed
2026-10-10 Priority changed: MEDIUM → LOW

References

Patch 2

Other 1

FalkorDB 4.20.0 release notes

TI-2026-05312 Unauthenticated Path Traversal in FalkorDB Browser Leads to Remote Code Execution CVSS 3.1CRITICAL 9.8
TI-2026-69850 Heap out-of-bounds write in FalkorDB Bolt RESET handler CVSS 4.0CRITICAL 9.3
TI-2026-69847 Double free and use-after-free in FalkorDB RDB loading CVSS 4.0CRITICAL 9.3
TI-2026-69851 Out-of-bounds write in FalkorDB Bolt WebSocket frame handling CVSS 4.0HIGH 8.8
TI-2026-08883 QueryWeaver Authentication Bypass via Email Signup Token Issuance for Existing Accounts CVSS 4.0HIGH 8.8
TI-2026-69848 Heap out-of-bounds read in FalkorDB via crafted RDB stream CVSS 4.0HIGH 8.8

See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences