High, CVSS 8.2MavenPublished
Apache Camel-Neo4j: JSON property names from the CamelNeo4jMatchProperties header are interpolated into the Cypher WHERE clause without validation, allowing Cypher injection (incomplete remediation…
CVE-2026-46591 · GHSA-q86m-qjpm-vqcw
- Affected
- Maven org.apache.camel:camel-neo4j >= 4.10.0, < 4.14.8; >= 4.15.0, < 4.18.3; >= 4.19.0, < 4.21.0
- Fixed in
- 4.21.04.14.84.18.3· Vendor fix available
- Issue
- Improper Neutralization of Special Elements in Data Query Logic vulnerability in Apache Camel Neo4j component. The camel-neo4j producer builds the Cypher WHERE clause for its match/retrieve and delete operations from the CamelNeo4jMatchProperties map. CVE-2025-66169 addressed Cypher injection through the property values by binding them as query parameters ($paramN), but the property names (the JSON keys of that map) were still concatenated into the query string verbatim in Neo4jProducer.retrieveNodes() and deleteNode(). A property name containing Cypher syntax therefore alters the structure of the executed query. Where a route maps untrusted input into the CamelNeo4jMatchProperties map - for example by passing a request body as the match map, or from a consumer that does not filter inbound Camel headers - an attacker who controls the JSON key names can inject arbitrary Cypher and read, modify or delete any node or relationship in the Neo4j database. The CamelNeo4jMatchProperties…
Recommended action: Upgrade to 4.21.0, 4.18.3 or 4.14.8 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.