---
id: "CVE-2026-114510"
kind: "vulnerability"
aliases: ["CVE-2026-114510"]
title: "Flexible GraphRAG: crafted documents inject Cypher into FalkorDB graph queries"
severity: "high"
cvss: 7.1
epss: 0.00241
exploited: false
status: "open"
category: "ai-tooling"
products: []
ecosystems: []
tags: ["ai-tooling", "falkordb", "flexible-graphrag", "graphrag", "python", "self-hosted"]
not_affected_if: ["default-config", "llamaindex-falkordb-store", "version-outside-range"]
published_at: "2026-10-22T15:17:05+00:00"
first_seen_at: "2026-10-23T21:57:31+00:00"
updated_at: "2026-10-25T03:31:36+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114510", "first_seen_at": "2026-10-23T21:57:31+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-114510", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# Flexible GraphRAG: crafted documents inject Cypher into FalkorDB graph queries

Flexible GraphRAG versions 0.6.0 through 0.8.2 escape quotes in the wrong order in the FalkorDB adapter, so entity values produced by the extraction model from ingested documents can break out of Cypher strings. An attacker who controls document content can modify or delete graph data and, where query results reach the user or LLM, read graph data.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed flexible-graphrag version, for example `pip show flexible-graphrag`, and whether it falls between `0.6.0` and `0.8.2`.
- Check whether the deployment sets `GRAPH_BACKEND=langchain` and `GRAPH_DB=falkordb`.
- Check whether untrusted users or documents can be ingested into the graph.

## Fix

- Upgrade flexible-graphrag to `0.8.2` or later.
- Until upgraded, restrict who can ingest documents or switch away from the langchain FalkorDB graph backend.

## Timeline

- 2026-10-23T21:57:31+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114510
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-114510

## From the sources

Flexible GraphRAG is a Python framework for building graph and retrieval-augmented generation applications across multiple graph, vector, and search backends. From 0.6.0 until 0.8.2, the _escape() helper in flexible-graphrag/langchain/graph/pg_store_adapters/falkordb_adapter.py escapes quotes before backslashes and then interpolates the result into Cypher assembled by FalkorDBAdapter.add_graph_documents, allowing an inserted escape to be doubled and a quote to terminate the string early. When GRAPH_BACKEND=langchain and GRAPH_DB=falkordb are configured, attacker-influenced ingested document content can cause the extraction model to produce malicious entity or relationship values that reach these queries, allowing injected Cypher clauses to modify or delete graph data and, when the calling code surfaces query results to the user or LLM, disclose graph data. Dynamic node and relationship type identifiers are also inserted into backtick-quoted query positions without safe parameterization. The LlamaIndex FalkorDB store is not affected. This issue is fixed in version 0.8.2.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_