EUVD-2026-84188
GHSA-jfwr-q2jc-29xf
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
Network-reachable command interface (AV:N/AC:L), but issuing module commands requires authorization (PR:L); no data disclosure (C:N), limited integrity from mis-propagated writes (I:L), and service/replication disruption (A:H).
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
4DescriptionCVE.org
The graph.UDF in FalkorDB (Redis module) v4.20.1 to v4.20.4 is not registered as a write command, leading to unexpected behavior within the application.
Articles & Coverage 1
AnalysisAI
Missing write-command registration for graph.UDF in the FalkorDB Redis module versions 4.20.1 through 4.20.4 allows a client that is already authenticated and authorized to issue module commands (CVSS PR:L, unauthenticated external attackers are not sufficient) to invoke a command that Redis does not treat as a write, producing incorrect behavior in deployments whose correctness depends on write-command semantics such as replication propagation, persistence, and replica handling. The assessed impact is primarily availability (A:H) with a minor integrity effect (I:L) and explicitly no confidentiality impact (C:N), giving a CVSS of 7.1; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the exposed version range is narrow. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the ability to send graph.UDF commands to a FalkorDB (Redis module) instance on versions v4.20.1 through v4.20.4; the CVSS PR:L indicates a client authenticated/authorized to issue module commands. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS of 7.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H) is driven almost entirely by the A:H availability impact plus a modest I:L, with explicitly no confidentiality impact (C:N) - which directly contradicts the 'Information Disclosure' tag applied to this record. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch version is identified in the available intelligence, and the single reference supplied (the upstream GitHub issue at https://github.com/FalkorDB/FalkorDB/issues/2401) is not a fix; absence of a published patch is not confirmation that none exists, so confirm current status with the vendor and monitor that issue for a fixed FalkorDB release before upgrading beyond 4.20.4. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, confirm whether any FalkorDB Redis module instances are running versions 4.20.1 through 4.20.4, and restrict module command permissions (e.g., graph.UDF) to only trusted authenticated users, disabling the command where feasible via Redis ACLs or module configuration. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Privilege escalation to root in the LiteSpeed User-End cPanel Plugin (versions 2.3 through before 2.4.5) lets attackers
UAF in Redis 8.2.1 via crafted Lua scripts by authenticated users. EPSS 12.4%. Patch available.
It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific
Memory Corruption was discovered in the cmsgpack library in the Lua subsystem in Redis before 3.2.12, 4.x before 4.0.10,
Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user
Redis before 2.8.21 and 3.x before 3.0.2 allows remote attackers to execute arbitrary Lua bytecode via the eval command.
A buffer overflow in Redis 3.2.x prior to 3.2.4 causes arbitrary code execution when a crafted command is sent. Rated cr
Code injection in OneUptime monitoring via custom JS monitor using vm module. PoC and patch available.
RESP protocol command injection in Predis, the popular PHP client for Redis and Valkey, affects versions 3.0.0-RC1 throu
In applications using jfinal 4.9.08 and below, there is a deserialization vulnerability when using redis,may be vulnerab
An issue was found in Apache Airflow versions 1.10.10 and below. Rated critical severity (CVSS 9.8), this vulnerability
An Integer Overflow issue was discovered in the struct library in the Lua subsystem in Redis before 3.2.12, 4.x before 4
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today