CVE-2026-88410

Deferred Deferred - Pending Action

Graph UDF Unregistered Write Command in FalkorDB

Publication date: 2026-09-21

Last updated on: 2026-09-24

Assigner: MITRE

Description

The graph.UDF in FalkorDB (Redis module) v4.20.1 to v4.20.4 is not registered as a write command, leading to unexpected behavior within the application.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-21

Last Modified

2026-09-24

Generated

2026-10-12

AI Q&A

2026-09-22

EPSS Evaluated

2026-10-10

NVD

CVE-2026-88410

Affected Vendors & Products

Vendor	Product	Version / Range
falkordb	falkordb	From 4.20.1 (inc) to 4.20.4 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

The vulnerability in FalkorDB (Redis module) versions 4.20.1 to 4.20.4 involves the graph.UDF function not being registered as a write command. This can cause unexpected behavior in the application, potentially leading to unintended data modifications or disruptions.

Detection Guidance

To detect this vulnerability, monitor for unauthorized use of the graph.UDF command on read-only replicas or unexpected JavaScript execution in FalkorDB. Check for state divergence between primary and replica servers. Review logs for infinite loops in UDFs causing worker thread hangs. Ensure proper ACL key pattern scoping and memory pressure handling for UDFs.

Impact Analysis

This vulnerability may allow unauthorized users to execute write operations through the graph.UDF function, potentially leading to data corruption, loss of integrity, or application instability. It could also enable attackers to manipulate data if they gain access to the system.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or other standards as it involves unexpected behavior due to a misregistered write command in FalkorDB. However, if exploited, it could lead to unauthorized data modifications, potentially violating integrity requirements in compliance frameworks.

Mitigation Strategies

Upgrade FalkorDB to a version where the graph.UDF is properly registered as a write command. Avoid using vulnerable versions (v4.20.1 to v4.20.4) until patched.

Hi! I’m here to help you understand CVE-2026-88410. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70