{"id":"CVE-2026-114510","kind":"vulnerability","aliases":["CVE-2026-114510"],"related":[],"title":"Flexible GraphRAG: crafted documents inject Cypher into FalkorDB graph queries","description":"Flexible GraphRAG is a Python framework for building graph and retrieval-augmented generation applications across multiple graph, vector, and search backends. From 0.6.0 until 0.8.2, the _escape() helper in flexible-graphrag/langchain/graph/pg_store_adapters/falkordb_adapter.py escapes quotes before backslashes and then interpolates the result into Cypher assembled by FalkorDBAdapter.add_graph_documents, allowing an inserted escape to be doubled and a quote to terminate the string early. When GRAPH_BACKEND=langchain and GRAPH_DB=falkordb are configured, attacker-influenced ingested document content can cause the extraction model to produce malicious entity or relationship values that reach these queries, allowing injected Cypher clauses to modify or delete graph data and, when the calling code surfaces query results to the user or LLM, disclose graph data. Dynamic node and relationship type identifiers are also inserted into backtick-quoted query positions without safe parameterization. The LlamaIndex FalkorDB store is not affected. This issue is fixed in version 0.8.2.","summary":"Flexible GraphRAG versions 0.6.0 through 0.8.2 escape quotes in the wrong order in the FalkorDB adapter, so entity values produced by the extraction model from ingested documents can break out of Cypher strings. An attacker who controls document content can modify or delete graph data and, where query results reach the user or LLM, read graph data.","severity":"high","cvss":7.1,"epss":0.00241,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","falkordb","flexible-graphrag","graphrag","python","self-hosted"],"not_affected_if":["default-config","llamaindex-falkordb-store","version-outside-range"],"how_to_check":"- Check the installed flexible-graphrag version, for example `pip show flexible-graphrag`, and whether it falls between `0.6.0` and `0.8.2`.\n- Check whether the deployment sets `GRAPH_BACKEND=langchain` and `GRAPH_DB=falkordb`.\n- Check whether untrusted users or documents can be ingested into the graph.","fix":"- Upgrade flexible-graphrag to `0.8.2` or later.\n- Until upgraded, restrict who can ingest documents or switch away from the langchain FalkorDB graph backend.","status":"open","published_at":"2026-10-22T15:17:05+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","triaged_at":"2026-10-25T03:31:36+00:00","updated_at":"2026-10-25T03:31:36+00:00","category":"ai-tooling","confidence":0.7,"triage":{"at":"2026-10-25T03:31:36Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade flexible-graphrag to `0.8.2` or later.\n- Until upgraded, restrict who can ingest documents or switch away from the langchain FalkorDB graph backend.","reach":"unknown","title":"Flexible GraphRAG: crafted documents inject Cypher into FalkorDB graph queries","impact":"medium","summary":"Flexible GraphRAG versions 0.6.0 through 0.8.2 escape quotes in the wrong order in the FalkorDB adapter, so entity values produced by the extraction model from ingested documents can break out of Cypher strings. An attacker who controls document content can modify or delete graph data and, where query results reach the user or LLM, read graph data.","category":"ai-tooling","nicknames":[],"who_cares":["python","flexible-graphrag","falkordb","graphrag","self-hosted"],"confidence":0.7,"needs_auth":"unknown","worst_case":"Attacker modifies or deletes graph data and may read it back.","analyst_note":"Confirm from the NVD or upstream advisory whether ingestion requires authentication and whether the upstream fix commit is available to check against the code path.","how_to_check":"- Check the installed flexible-graphrag version, for example `pip show flexible-graphrag`, and whether it falls between `0.6.0` and `0.8.2`.\n- Check whether the deployment sets `GRAPH_BACKEND=langchain` and `GRAPH_DB=falkordb`.\n- Check whether untrusted users or documents can be ingested into the graph.","needs_analyst":true,"not_affected_if":["default-config","llamaindex-falkordb-store","version-outside-range"],"who_is_affected":"Teams running Flexible GraphRAG with the langchain graph backend and FalkorDB as the graph database are exposed, especially if ingested documents come from users or external sources the team does not control. The LlamaIndex FalkorDB store is not affected, and deployments on other graph databases or versions outside 0.6.0 to 0.8.2 can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000733,"input_tokens":3632,"output_tokens":739,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-114510':13A,16A '-2026':12A,15A '/langchain/graph/pg_store_adapters/falkordb_adapter.py':119C '0.6.0':32B,109C '0.8.2':34B,111C,240C 'across':101C 'adapt':44B 'affect':233C 'ai':18B 'ai-tool':17B 'allow':136C,183C 'also':216C 'applic':100C 'assembl':131C 'attack':63B,162C 'attacker-influenc':161C 'augment':98C 'backend':107C,153C 'backslash':123C 'backtick':220C 'backtick-quot':219C 'break':57B 'build':93C 'call':196C 'caus':168C 'claus':186C 'code':197C 'configur':160C 'content':67B,166C 'control':65B 'craft':3A 'cve':11A,14A 'cypher':6A,60B,130C,185C 'data':73B,85B,192C,208C 'db':157C 'delet':71B,190C 'disclos':206C 'document':4A,55B,66B,135C,165C 'doubl':142C 'dynam':209C 'earli':150C 'entiti':46B,175C 'escap':35B,113C,120C,139C 'extract':51B,170C 'falkordb':8A,20B,43B,158C,229C 'falkordbadapter.add':133C 'fix':237C 'flexibl':1A,22B,29B,86C,117C 'flexible-graphrag':21B,116C 'framework':91C 'generat':99C 'graph':9A,72B,84B,94C,103C,134C,152C,156C,191C,207C 'graphrag':2A,23B,24B,30B,87C,118C 'helper':114C 'host':28B 'identifi':214C 'influenc':163C 'ingest':54B,164C 'inject':5A,184C 'insert':138C,217C 'interpol':126C 'issu':235C 'langchain':154C 'llamaindex':228C 'llm':82B,205C 'malici':174C 'model':52B,171C 'modifi':69B,188C 'multipl':102C 'node':210C 'order':40B 'parameter':226C 'posit':223C 'produc':48B,173C 'python':25B,90C 'queri':10A,76B,182C,199C,222C 'quot':36B,121C,145C,221C 'reach':78B,180C 'read':83B 'relationship':177C,212C 'result':77B,128C,200C 'retriev':97C 'retrieval-aug':96C 'safe':225C 'search':106C 'self':27B 'self-host':26B 'store':230C 'string':61B,149C 'surfac':198C 'termin':147C 'tool':19B 'type':213C 'user':80B,203C 'valu':47B,178C 'vector':104C 'version':31B,239C 'without':224C 'wrong':39B","nicknames":[],"mitigations":[],"who_affected":"Teams running Flexible GraphRAG with the langchain graph backend and FalkorDB as the graph database are exposed, especially if ingested documents come from users or external sources the team does not control. The LlamaIndex FalkorDB store is not affected, and deployments on other graph databases or versions outside 0.6.0 to 0.8.2 can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T15:17:05+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114510","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114510","severity":null,"published_at":"2026-10-22T15:17:05+00:00","modified_at":"2026-10-22T17:29:28+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114510","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114510","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}