CVE-2026-107911 in FalkorDB
Summary
by MITRE • 10/09/2026
A type confusion vulnerability in the _read_flags function (src/commands/cmd_dispatcher.c) in FalkorDB before 4.20.0 allows a remote authenticated attacker who can run GRAPH.QUERY to cause a denial of service and possibly disclose or corrupt memory. The function accepts a --bolt argument from any client and casts the following command argument, a Redis string object, to a Bolt client structure without checking its origin; the result-set code then dereferences pointers read from that object. The argument is parsed even when the Bolt endpoint is disabled, so default configurations are affected.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/09/2026
The vulnerability identified in FalkorDB prior to version 4.20.0 represents a critical type confusion flaw located within the _read_flags function of the command dispatcher module. This defect arises from an improper assumption regarding the origin and structure of input data received by the server. Specifically, the application accepts a --bolt argument from any connected client session without validating whether that connection actually originates from a legitimate Bolt protocol endpoint. In secure software architecture, it is imperative to verify the context and provenance of incoming requests before processing them through specialized handlers. By failing to enforce this boundary check, the system allows an attacker who has authenticated access and possesses the ability to execute GRAPH.QUERY commands to inject maliciously crafted arguments that bypass expected security controls.
The technical core of the vulnerability lies in how the application processes command-line style flags passed within query parameters. The _read_flags function retrieves a Redis string object representing the --bolt argument and immediately casts this generic data structure into a specific Bolt client structure pointer without performing any type verification or origin validation. This unsafe cast assumes that if the flag is present, it must belong to an active Bolt connection context. However, since the parsing logic executes regardless of whether the Bolt endpoint is actually enabled in the server configuration, default installations are inherently vulnerable. The subsequent code path attempts to dereference pointers stored within this misinterpreted structure, leading to memory access violations or unintended data interpretation because the underlying bytes do not conform to the expected layout of a valid Bolt client object.
From an operational perspective, this type confusion can lead to severe consequences including denial of service and potential arbitrary code execution through memory corruption. When the application dereferences invalid pointers derived from the misinterpreted string object, it may trigger segmentation faults or other crashes that disrupt database availability for all users. More critically, if the attacker can control the content of the Redis string argument with sufficient precision, they might manipulate heap structures to achieve out-of-bounds reads or writes. This capability opens the door to information disclosure where sensitive memory contents are leaked back to the attacker, or further exploitation vectors such as remote code execution could be developed by overwriting function pointers or object metadata in memory.
This vulnerability aligns with CWE-843, which describes access of incorrect type assumption errors, and specifically relates to improper input validation leading to undefined behavior during pointer casting. In terms of the MITRE ATT&CK framework, this flaw facilitates initial exploitation techniques associated with T1059 Command and Scripting Interpreter abuse or potentially T1203 Exploitation for Client Execution if memory corruption is leveraged effectively. The attack vector requires authentication but does not require physical access or complex network positioning beyond standard TCP connectivity to the database port, classifying it as a remote authenticated attack with high impact potential on confidentiality, integrity, and availability.
To mitigate this risk, organizations running FalkorDB must upgrade immediately to version 4.20.0 or later where the type checking logic has been corrected to validate the source of incoming arguments against active protocol endpoints before processing them. Until an update is applied, administrators should consider restricting network access to the database port using firewall rules to limit exposure only to trusted clients with known authentication credentials. Additionally, implementing strict input validation at the application layer for any custom flags or parameters passed through query interfaces can provide a defense-in-depth measure against similar type confusion attacks in other components of the system. Regular security audits and static analysis tools configured to detect unsafe pointer casts should be integrated into the development pipeline to prevent recurrence of such logic errors in future releases.