rootpwn

high · CVSS v3 7.1

CVE-2026-88410

The FalkorDB Redis module (v4.20.1‑v4.20.4) contains a bug where the graph.UDF command is not registered as a write command, causing unexpec

Overview

The FalkorDB Redis module (v4.20.1‑v4.20.4) contains a bug where the graph.UDF command is not registered as a write command, causing unexpected application behavior. This flaw can lead to data integrity issues or denial of service within systems that rely on FalkorDB for graph operations. Defenders should be aware that any deployment of these specific module versions is potentially impacted.

Description

The graph.UDF in FalkorDB (Redis module) v4.20.1 to v4.20.4 is not registered as a write command, leading to unexpected behavior within the application.

Impact

The misregistration can compromise the integrity of graph data, potentially allowing unintended modifications or corrupting data structures. Availability may also be affected if the module enters an unstable state, leading to service interruptions. Confidentiality is not directly impacted, but the integrity and availability of the application are at risk for administrators, developers, and end‑users of FalkorDB.

Remediation

Apply the latest FalkorDB release (v4.20.5 or newer) where graph.UDF is correctly registered as a write command. If an upgrade is not immediately possible, restrict or disable the graph.UDF command via ACLs or configuration, and monitor Redis logs for anomalous command usage. Verify that all instances are updated and test for normal operation after remediation.

Risk context

The vulnerability is rated high with a CVSS v3 score of 7.1. While no EPSS data is available, the severity indicates a moderate to high urgency for affected deployments to apply the patch or mitigation promptly.

Affected products

  • FalkorDB v4.20.1
  • FalkorDB v4.20.2
  • FalkorDB v4.20.3
  • FalkorDB v4.20.4
  • Redis module FalkorDB

Scores

Severity
high
CVSS v2
7.5
CVSS v3
7.1
CVSS v4
—
EPSS
—

FalkorDB Redis Command-Registration Data-Integrity HighSeverity Patch Defender

← All CVEs

Related CVEs

high

CVE-2026-94144

A high‑severity SQL injection flaw exists in drogonframework’s ORM component, allowing remote attackers to inject arbitrary SQL via the makeCriteria function. The vulnerability is present in all drogon releases up to 1.9.13 and has been publicly exploited. Defenders should immediately update or patch the framework to mitigate the risk.

View analysis

high

CVE-2026-88406

FalkorDB Redis module versions 4.20.1 through 4.20.4 contain a stack overflow in the _ValidateUnion_Clauses function that can be triggered by crafted input. This flaw allows an attacker to cause a denial‑of‑service (DoS) by crashing the module. The vulnerability is limited to the FalkorDB module and does not expose data or allow remote code execution.

View analysis

high

CVE-2026-88407

FalkorDB, a Redis module, has an out-of-bounds read in the node_token_count/relation_token_count component. Versions 4.20.1 to 4.20.4 are affected. The flaw can lead to a denial of service when a crafted input is processed.

View analysis

high

CVE-2026-88411

Improper error handling in the GRAPH.EFFECT component (/effects/effects_apply.c) of FalkorDB (Redis module) v4.20.1 leads to a Denial of Service (DoS) within the application.

View analysis