CVE-2026-114510

{
  "etk_id": "ETK-2026-2523",
  "cve_id": "CVE-2026-114510",
  "display_id": "CVE-2026-114510",
  "ghsa_id": "GHSA-vqrg-773h-4wxc",
  "euvd_id": "EUVD-2026-108207",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Cypher injection in flexible-graphrag FalkorDB adapter",
  "summary": "Flexible-graphrag versions 0.6.0 through 0.8.1 can construct unsafe Cypher queries when using the LangChain FalkorDB backend. An attacker able to influence ingested documents may cause graph records to be changed or removed, and may expose graph data if query output is returned to users or an LLM. The affected configuration requires GRAPH_BACKEND=langchain and GRAPH_DB=falkordb.",
  "mitigation": "Upgrade flexible-graphrag to version 0.8.2 or later. Until upgraded, disable the LangChain FalkorDB backend and restrict ingestion of attacker-controlled content.",
  "vendor": "stevereiner",
  "product": "flexible-graphrag",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0.6.0, < 0.8.2"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "0.8.2"
      ],
      "package_name": "flexible-graphrag",
      "purl": null
    }
  ],
  "cwes": [
    116
  ],
  "cvss_score": 7.1,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 19.322238966666667,
  "t0_at": "2026-10-22T14:46:52.353000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-22T14:46:52.353000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-22T14:46:52.353000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-114510"
    }
  }
}