CVE-2026-114510: Flexible GraphRAG: Cypher injection via FalkorDB adapter

Q: Is CVE-2026-114510 actively exploited?

No confirmed active exploitation of CVE-2026-114510 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-114510?

1) Upgrade flexible-graphrag to 0.8.2 or later. 2) If patching is delayed, switch to a non-affected graph backend or the LlamaIndex FalkorDB store, or pause ingestion of untrusted documents. 3) Restrict who and what can feed documents into ingestion pipelines and review the provenance of existing sources. 4) Run FalkorDB with least-privilege credentials, ideally with limited write and delete rights for the ingestion service. 5) Take regular graph backups so tampering can be rolled back. 6) Monitor FalkorDB query logs for unexpected clauses such as DELETE, DETACH, SET, or extra MATCH statements, and for entity values with unusual backslashes, quotes, or backticks. 7) Audit the graph for anomalous entities created since adopting 0.6.0.

Q: What systems are affected by CVE-2026-114510?

This vulnerability affects the following AI/ML architecture patterns: RAG pipelines, GraphRAG, graph databases, LLM document ingestion pipelines.

Q: What is the CVSS score for CVE-2026-114510?

CVE-2026-114510 has a CVSS v3.1 base score of 7.1 (HIGH). The EPSS exploitation probability is 0.36%.

GHSA-vqrg-773h-4wxcHIGH

Published October 22, 2026

CISO Take

Flexible GraphRAG versions 0.6.0 to before 0.8.2 contain a Cypher injection flaw in the FalkorDB adapter: a faulty escape routine lets quotes slip through into graph queries built from LLM-extracted entities. Because the malicious values originate from ingested documents, an attacker who can get a document into the pipeline can steer the extraction model into producing payloads that modify or delete graph data, and potentially disclose it if query results are shown to users or LLMs. Exposure is limited to deployments configured with GRAPH_BACKEND=langchain and GRAPH_DB=falkordb (the LlamaIndex FalkorDB store is unaffected), and there is no KEV listing, public exploit, or Nuclei template; EPSS and dependent counts are unavailable, so blast radius is unknown. Upgrade to 0.8.2 and review who can submit documents to ingestion pipelines.

Sources:NVDGitHub AdvisoryATLAS

What is the risk?

CVSS 7.1 (high). Network-reachable but high complexity, since exploitation depends on an attacker-controlled document being ingested and an extraction LLM reproducing the payload. Low privileges and user interaction are required. No known exploitation, public exploit, or KEV listing; EPSS is unavailable. Risk is concentrated in deployments with the specific langchain and FalkorDB configuration that ingest untrusted or semi-trusted content (shared drives, web crawls, customer uploads). Impact covers integrity of the knowledge graph and potential confidentiality loss.

How does the attack unfold?

Initial Access

Attacker plants a crafted document in a source that is ingested by the GraphRAG pipeline.

AML.T0051.001

Payload Generation

The extraction LLM turns the document text into entity or relationship values containing escape-breaking quote and backslash sequences.

AML.T0070

Exploitation

The flawed escape routine lets the value terminate the string, and injected Cypher runs against FalkorDB.

AML.T0049

Impact

Graph data is modified, deleted, or disclosed through surfaced query results, corrupting retrieval integrity.

AML.T0085.000

Initial Access

Attacker plants a crafted document in a source that is ingested by the GraphRAG pipeline.

AML.T0051.001

Payload Generation

The extraction LLM turns the document text into entity or relationship values containing escape-breaking quote and backslash sequences.

AML.T0070

Exploitation

The flawed escape routine lets the value terminate the string, and injected Cypher runs against FalkorDB.

AML.T0049

Impact

Graph data is modified, deleted, or disclosed through surfaced query results, corrupting retrieval integrity.

AML.T0085.000

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
LlamaIndex	pip	>= 0.6.0, < 0.8.2	`0.8.2`
52.6KPushed 8d ago25% patched~4d to patchFull package profile →

Do you use LlamaIndex? You're affected.

How severe is it?

CVSS 3.1

7.1 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 30% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AVNetwork

ACHigh

PRLow

UIRequired

SUnchanged

CHigh

IHigh

AHigh

What should I do?

1 step

1) Upgrade flexible-graphrag to 0.8.2 or later. 2) If patching is delayed, switch to a non-affected graph backend or the LlamaIndex FalkorDB store, or pause ingestion of untrusted documents. 3) Restrict who and what can feed documents into ingestion pipelines and review the provenance of existing sources. 4) Run FalkorDB with least-privilege credentials, ideally with limited write and delete rights for the ingestion service. 5) Take regular graph backups so tampering can be rolled back. 6) Monitor FalkorDB query logs for unexpected clauses such as DELETE, DETACH, SET, or extra MATCH statements, and for entity values with unusual backslashes, quotes, or backticks. 7) Audit the graph for anomalous entities created since adopting 0.6.0.

How is it classified?

Prompt InjectionData ExtractionData LeakageFrameworkRAGAML.T0049- Exploit Public-Facing Application AML.T0051.001- Indirect AML.T0070- RAG Poisoning AML.T0085.000- RAG Databases

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.7.4-Quality of data for AI systems

NIST AI RMF

MANAGE 2.3-Responses to unknown risks and risk treatment

OWASP LLM Top 10

LLM01-Prompt InjectionLLM05-Improper Output HandlingLLM08-Vector and Embedding Weaknesses

Frequently Asked Questions

What is CVE-2026-114510?

Is CVE-2026-114510 actively exploited?

No confirmed active exploitation of CVE-2026-114510 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-114510?

1) Upgrade flexible-graphrag to 0.8.2 or later. 2) If patching is delayed, switch to a non-affected graph backend or the LlamaIndex FalkorDB store, or pause ingestion of untrusted documents. 3) Restrict who and what can feed documents into ingestion pipelines and review the provenance of existing sources. 4) Run FalkorDB with least-privilege credentials, ideally with limited write and delete rights for the ingestion service. 5) Take regular graph backups so tampering can be rolled back. 6) Monitor FalkorDB query logs for unexpected clauses such as DELETE, DETACH, SET, or extra MATCH statements, and for entity values with unusual backslashes, quotes, or backticks. 7) Audit the graph for anomalous entities created since adopting 0.6.0.

What systems are affected by CVE-2026-114510?

This vulnerability affects the following AI/ML architecture patterns: RAG pipelines, GraphRAG, graph databases, LLM document ingestion pipelines.

What is the CVSS score for CVE-2026-114510?

CVE-2026-114510 has a CVSS v3.1 base score of 7.1 (HIGH). The EPSS exploitation probability is 0.36%.

What is the AI security impact?

Affected AI Architectures

RAG pipelinesGraphRAGgraph databasesLLM document ingestion pipelines

MITRE ATLAS Techniques

AML.T0049Exploit Public-Facing Application

AML.T0051.001Indirect

AML.T0070RAG Poisoning

AML.T0085.000RAG Databases

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.7.4

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM01, LLM05, LLM08

What are the technical details?

Original Advisory

Flexible GraphRAG is a Python framework for building graph and retrieval-augmented generation applications across multiple graph, vector, and search backends. From 0.6.0 until 0.8.2, the _escape() helper in flexible-graphrag/langchain/graph/pg_store_adapters/falkordb_adapter.py escapes quotes before backslashes and then interpolates the result into Cypher assembled by FalkorDBAdapter.add_graph_documents, allowing an inserted escape to be doubled and a quote to terminate the string early. When GRAPH_BACKEND=langchain and GRAPH_DB=falkordb are configured, attacker-influenced ingested document content can cause the extraction model to produce malicious entity or relationship values that reach these queries, allowing injected Cypher clauses to modify or delete graph data and, when the calling code surfaces query results to the user or LLM, disclose graph data. Dynamic node and relationship type identifiers are also inserted into backtick-quoted query positions without safe parameterization. The LlamaIndex FalkorDB store is not affected. This issue is fixed in version 0.8.2.

Exploitation Scenario

An attacker plants a document containing crafted text in a source the organization ingests, such as a shared wiki, uploaded PDF, or crawled webpage. The extraction LLM turns the text into entity or relationship values containing a backslash-and-quote sequence that the flawed escape routine doubles, terminating the Cypher string early. The remainder of the value runs as Cypher, for example deleting nodes or rewriting relationships to poison retrieval results. If the application surfaces query results, the attacker can also craft clauses that return other graph data in answers.

Weaknesses (CWE)

CWE-116Improper Encoding or Escaping of OutputPrimary CWE-116Improper Encoding or Escaping of OutputPrimary CWE-943Improper Neutralization of Special Elements in Data Query LogicPrimary CWE-943Improper Neutralization of Special Elements in Data Query LogicPrimary CWE-116Improper Encoding or Escaping of Output CWE-943Improper Neutralization of Special Elements in Data Query Logic

CWE-116 — Improper Encoding or Escaping of Output: The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.

[Architecture and Design] Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. For example, consider using the ESAPI Encoding control [REF-45] or a similar tool, library, or framework. These will help the programmer encode outputs in a manner less prone to error. Alternately, use built-in functions, but consider using wrappers in case those functions are discovered to have a vulnerability.
[Architecture and Design] If available, use structured mechanisms that automatically enforce the separation between data and code. These mechanisms may be able to provide the relevant quoting, encoding, and validation automatically, instead of relying on the developer to provide this capability at every point where output is generated. For example, stored procedures can enforce database query structure and reduce the likelihood of SQL injection.

Source: MITRE CWE corpus.