The vulnerability arises from improper authentication handling in FalkorDB’s Bolt API. When the system sends an empty AUTH command to Redis, it only interprets a WRONGPASS error as a password requirement. Any other error, such as LOADING, MASTERDOWN, or OOM, is mistakenly treated as successful authentication, granting the client access to execute graph queries without credentials. This bypass allows a remote attacker to read or modify data, potentially compromising confidentiality, integrity, and availability of the database. The weakness is classified as CWE‑287.

Affected products are FalkorDB deployments built before version 4.20.0 that have the Bolt endpoint enabled. The Bolt protocol support, which is responsible for the flaw, was removed entirely in 4.20.0. Deployments that keep the BOLT_PORT configuration disabled by default are not affected. Therefore, environments that have explicitly enabled the Bolt service and are running any version prior to 4.20.0 are at risk.

The CVSS score of 9.2 marks this flaw as critical, and because the exploit requires only remote unauthenticated access to the Bolt port, the attack surface is wide when the port is exposed. EPSS is not available, so the current exploitation probability is unknown, and the vulnerability is not listed in the CISA KEV. Nonetheless, the easy exploitation path and lack of authentication provide a high level of risk for attackers who can reach the service. Administrators should treat this as a priority, especially for systems with a publicly reachable Bolt endpoint.