CVE-2026-88410

Executive Summary

CVE-2026-88410 is a logic/authorization weakness in FalkorDB, a graph database implemented as a Redis module, affecting versions 4.20.1 through 4.20.4. The graph.UDF operation is not registered as a write command, meaning operations invoked through this interface bypass write-command protections and trigger unexpected application behavior. With a CVSS base score of 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H), the flaw allows an authenticated, low-privileged network attacker to cause a high-availability impact and a limited integrity impact. No public proof-of-concept, Nuclei template, or vendor patch currently exists, and the vulnerability has not been added to CISA KEV.

Technical Analysis

The root cause is a command-classification defect. FalkorDB extends Redis with graph capabilities. Redis itself enforces a distinction between read and write commands, exposing this distinction through mechanisms such as the COMMAND introspection family, ACL key/permission rules, and read-only replica enforcement. A command that is not flagged as a "write" command is treated by the surrounding Redis runtime as a non-mutating operation. That classification controls whether the command is permitted on read-only replicas, whether it is subject to write-oriented ACL enforcement, and how the runtime expects the operation to behave with respect to data state.

According to the NVD description, the graph.UDF operation in FalkorDB v4.20.1 to v4.20.4 is not registered as a write command. This misclassification means that graph.UDF is handled as though it does not mutate server state, even though its function (user-defined function handling within the graph engine) can produce state-changing or resource-intensive effects. As a result:

• The operation can be invoked in contexts where write commands are expected to be rejected (for example, against a read-only replica or under an ACL policy intended to restrict mutating operations).
• The runtime's assumptions about the operation's side effects are violated, producing "unexpected behavior within the application," as stated in the description.

The attack surface is the FalkorDB/Redis command interface. Any client that can reach the FalkorDB instance and is permitted to issue the graph.UDF command — i.e., an attacker holding even low-privileged credentials (PR:L) — can trigger the flaw over the network (AV:N) with no user interaction (UI:N) and no special conditions (AC:L).

The high availability impact (A:H) and limited integrity impact (I:L) in the CVSS vector are consistent with a write-classification defect: because the command is not gated as a write operation, it can be executed in paths where it should be blocked, consuming graph-processing resources, altering state inconsistently, or pushing the module into an undefined condition. Confidentiality impact is rated None (C:N) in the supplied vector.

Note on precision: the description does not specify the exact handler routine, the internal registration table, the Redis command-flag constant used, or the precise payload syntax accepted by graph.UDF. Those implementation details are not asserted here. What is derivable is the vulnerability class — improper command/operation classification leading to an access-control and state-management bypass — and its observable consequence: operations that should be treated as writes are treated as non-writes.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class and the details in the NVD description.

1) Reconnaissance / target identification. The attacker identifies an exposed FalkorDB instance reachable over the network. FalkorDB runs as a Redis module, so discovery focuses on the Redis service port and on distinguishing FalkorDB-enabled instances from stock Redis. The attacker confirms reachability and, crucially, whether authentication is required and what privilege level their credentials hold (the vector assumes low privileges, PR:L). Service fingerprinting can also reveal the module version, allowing the attacker to confirm whether the deployment falls in the 4.20.1–4.20.4 range.

2) Triggering the flaw. The attacker issues the graph.UDF operation against the target. Because graph.UDF is not registered as a write command, the surrounding runtime does not apply the write-command restrictions it normally would. The command therefore proceeds in a context where a correctly-classified write command would have been rejected or constrained — for example, on a deployment whose policy or topology is intended to permit only read operations. This is the classification bypass at the heart of the CVE.

3) Payload / execution method. At the vulnerability-class level, the "payload" is simply a well-formed invocation of graph.UDF sent by an authenticated low-privileged client. The attacker does not need to craft memory-safety exploits, because the defect is logical rather than a memory-corruption bug. The NVD description does not disclose the exact argument syntax or the request/response format of graph.UDF, so no specific command string is provided here.

4) Post-exploitation impact. Successful triggering produces the "unexpected behavior within the application" described by NVD. Given the CVSS vector (I:L, A:H, C:N), the realistic impact is disruption of availability — the graph engine or the broader Redis process can be driven into an unintended state or resource-exhausting condition — together with limited, consistency-affecting state changes. Because the command escapes write-classification controls, an operator's assumption that a replica or restricted account cannot mutate state is violated, widening the effective blast radius of a low-privileged account.

No exploit-in-the-wild activity, threat actor campaign, or KEV listing is associated with this CVE at the time of writing.

Impact Assessment

• Confidentiality (C:N): No confidentiality impact per the supplied vector. The flaw is not an information-disclosure primitive.
• Integrity (I:L): Limited integrity impact. Misclassification of a state-effecting operation allows unintended state changes or inconsistent graph state, but the description does not evidence broad, arbitrary data corruption.
• Availability (A:H): High availability impact. This is the dominant risk. The operation can be invoked from contexts where it should be blocked, enabling resource exhaustion, application instability, or denial of service against the graph database.
• Attack vector (AV:N) / complexity (AC:L): Remotely reachable and straightforward to attempt — no race condition or special timing required.
• Privileges required (PR:L): An attacker needs valid low-privileged credentials. This elevates the risk from anonymous Internet scanning to a realistic insider or compromised-credential scenario.

Business impact and blast radius. Affected systems are any deployment running FalkorDB v4.20.1–4.20.4 in front of Redis. Because FalkorDB is commonly deployed as a backing store for graph-based applications, a successful attack can take the graph layer offline (A:H), disrupting dependent applications and services that rely on graph queries. The integrity impact can leave the graph in an inconsistent state that requires reconciliation or restore. The bypass of write-classification also undermines isolation assumptions in replicated or multi-tenant deployments, meaning a single low-privileged account can affect operations that architects assumed were protected. There is no evidence of lateral movement or code execution in the available data, so blast radius is bounded by availability and limited integrity within the affected instance and its dependents.

Detection Guidance

Detection for this class of flaw focuses on (a) monitoring graph.UDF invocation, (b) detecting write-classified-context violations (e.g., UDF activity on replicas or restricted accounts), and (c) alerting on availability anomalies in the Redis/FalkorDB process.

Sigma Rule

title: FalkorDB graph.UDF Invocation Anomaly (CVE-2026-88410)
id: 9f1c7a2e-8841-4b0d-9b6e-202688410a01
status: experimental
description: Detects invocation of the FalkorDB graph.UDF operation, which is not
  registered as a write command (CVE-2026-88410) and should not normally be observed
  from low-privileged or read-only contexts.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-88410
author: Threat Intelligence
date: 2026/01/01
logsource:
  product: falkordb
  service: redis
detection:
  selection_cmd:
    command|contains: 'graph.UDF'
  selection_ctx:
    access_type:
      - 'read-only-replica'
      - 'restricted-acl'
      - 'low-privilege'
  condition: selection_cmd
falsepositives:
  - Legitimate administrative use of graph.UDF by authorized operators
  - Application workflows that intentionally invoke graph.UDF
level: high
tags:
  - attack.t1059
  - cve.2026.88410

YARA Rule

rule CVE_2026_88410_FalkorDB_graph_UDF
{
    meta:
        author      = "Threat Intelligence"
        description = "Detects references to the FalkorDB graph.UDF operation associated with CVE-2026-88410, where the command is not registered as a write command."
        reference   = "https://nvd.nist.gov/vuln/detail/CVE-2026-88410"
        date        = "2026-01-01"
        severity    = "high"

    strings:
        $cmd1 = "graph.UDF" ascii wide nocase
        $mod1 = "FalkorDB" ascii wide nocase
        $ver1 = "4.20.1" ascii
        $ver2 = "4.20.4" ascii

    condition:
        uint16(0) == 0x5A4D or uint32(0) == 0x464C457F or
        ( $mod1 and $cmd1 ) or
        ( $mod1 and any of ($ver*) )
}

Suricata IDS Rule

alert tcp any any -> any 6379 ( \
  msg:"CVE-2026-88410 FalkorDB graph.UDF write-classification bypass attempt"; \
  flow:established,to_server; \
  content:"graph.UDF"; nocase; \
  classtype:attempted-admin; \
  reference:cve,2026-88410; \
  reference:url,nvd.nist.gov/vuln/detail/CVE-2026-88410; \
  sid:2026884101; rev:1; )

Note: FalkorDB is a Redis module typically exposed on the Redis protocol port (default 6379). Adjust the destination port if the deployment uses a non-standard port. The content match is case-insensitive because Redis command casing is not significant.

Elastic Detection

sequence by process.entity_id with maxspan=30s
  [ network where destination.port == 6379 and
      network.protocol == "redis" ]
  [ process where process.name in ("redis-server", "falkordb") and
      process.command_line : "*graph.UDF*" ]

Alternative single-event correlation for environments that log Redis commands as process or file events:

any where process.name in ("redis-server", "falkordb") and
  process.command_line : "*graph.UDF*"

Splunk SPL Query

index=redis OR index=falkordb sourcetype=redis:command
| search command="graph.UDF" OR raw="*graph.UDF*"
| eval risk="CVE-2026-88410 - write-classification bypass"
| stats count min(_time) as first_seen max(_time) as last_seen
        values(client_ip) as sources values(user) as accounts
        by command risk
| where count > 0
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="falkordb,redis,cve_2026_88410,">
  <rule id="202688410" level="12">
    <decoded_as>redis</decoded_as>
    <match>graph.UDF</match>
    <description>CVE-2026-88410: FalkorDB graph.UDF invoked - write-command
      classification bypass may indicate exploitation attempt.</description>
    <mitre>
      <id>T1059</id>
    </mitre>
    <group>cve_2026_88410,</group>
  </rule>

  <rule id="202688411" level="13">
    <if_sid>202688410</if_sid>
    <match>read-only|replica|restricted</match>
    <description>CVE-2026-88410: graph.UDF invoked from a read-only / restricted
      context - high-confidence exploitation indicator.</description>
    <group>cve_2026_88410,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence exists from any tracked source. There is no vendor fix, no affected-version advisory entry, and no workaround published by the vendor. The version range 4.20.1–4.20.4 is drawn from the NVD description.

1) Immediate mitigations.

• Restrict network exposure of the FalkorDB/Redis port (default 6379). Do not expose the instance to untrusted networks; bind to trusted interfaces and enforce firewall allowlists.
• Enforce strong authentication and least privilege on the Redis/FalkorDB instance. Because the flaw requires only low privileges (PR:L), reducing the population of accounts that can authenticate meaningfully reduces the attack surface.
• Where the deployment uses Redis ACLs, audit which roles can issue graph.* commands and tighten them. Given that graph.UDF is not registered as a write command, do not assume write-oriented ACL rules alone will block it — explicitly deny graph.UDF for non-administrative roles if the ACL engine supports per-command rules.
• Avoid relying on read-only replicas as a control boundary for this command, since the misclassification can cause it to be permitted there.
• Monitor and rate-limit graph.UDF usage; alert on any invocation from low-privileged or read-only contexts.

2) Patch / upgrade steps.

• No patch is currently available. Track the FalkorDB project's release channels and the NVD entry for CVE-2026-88410 for a fixed version.
• When a fixed release is published, upgrade from the affected 4.20.1–4.20.4 range, then verify that graph.UDF is registered as a write command (for example, by inspecting the command's flags through Redis command-introspection functionality).
• Until then, treat all 4.20.1–4.20.4 deployments as vulnerable and apply the mitigations above.

3) Long-term hardening.

• Maintain a command-classification audit process so that any new or modified command's write/read flags are verified before release and after upgrades.
• Segment the graph database from general-purpose networks and place it behind an authenticated proxy or bastion.
• Enable comprehensive command logging and forward it to the SIEM, using the detection rules above for continuous monitoring.
• Apply defense in depth: least-privilege ACLs, replica protections, and resource limits to blunt the high-availability impact (A:H) if the command is invoked unexpectedly.

References

1. NVD — CVE-2026-88410: https://nvd.nist.gov/vuln/detail/CVE-2026-88410
2. FalkorDB project (vendor) — monitor release notes and security advisories for the fixed version: https://github.com/FalkorDB/FalkorDB
3. Redis — Command introspection and ACL documentation (context for read/write command classification and ACL enforcement): https://redis.io/docs/latest/commands/command/ and https://redis.io/docs/latest/operate/oss_and_stack/management/security/acl/
4. CISA Known Exploited Vulnerabilities Catalog — CVE-2026-88410 is not listed (checked at time of writing): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
5. FIRST EPSS — CVE-2026-88410 is not yet scored by FIRST.org: https://www.first.org/epss/

Threat actor campaign / exploit-in-the-wild evidence: none available at the time of writing. No public PoC, no Nuclei template, no exploit code, and no CISA KEV listing have been identified for CVE-2026-88410.