Apache Camel-Neo4j: JSON property names from the CamelNeo4jMatchProperties header are interpolated into the Cypher WHERE clause without validation, allowing Cypher injection (incomplete remediation of CVE-2025-66169)

🗓️ 06 Jul 2026 09:30:29Reported by GitHub Advisory DatabaseType

Cypher injection in Apache Camel-Neo4j via unvalidated property names in CamelNeo4jMatchProperties.

Reporter	Title	Published	Views	Family All 26
ATTACKERKB	CVE-2026-46591	6 Jul 202608:04	–	attackerkb
ATTACKERKB	CVE-2025-66169	14 Jan 202611:45	–	attackerkb
BDU FSTEC	The vulnerabilities of the `deleteNode()` and `retrieveNodes()` functions in the `Neo4jProducer` class of the `camel-neo4j` component of the Apache Camel framework allow a malicious actor to gain access to read, modify, or delete any nodes and relationships.	17 Jul 202600:00	–	bdu_fstec
Circl	CVE-2025-66169	13 Jan 202615:27	–	circl
Circl	CVE-2026-46591	5 Jul 202620:13	–	circl
CNNVD	Apache Camel 安全漏洞	14 Jan 202600:00	–	cnnvd
CVE	CVE-2025-66169	14 Jan 202611:45	–	cve
CVE	CVE-2026-46591	6 Jul 202608:04	–	cve
Cvelist	CVE-2025-66169 Apache Camel Neo4j: Cypher injection vulnerability in Camel-Neo4j component	14 Jan 202611:45	–	cvelist
Cvelist	CVE-2026-46591 Apache Camel: Camel-Neo4j: JSON property names from the CamelNeo4jMatchProperties header are interpolated into the Cypher WHERE clause without validation, allowing Cypher injection (incomplete remediation of CVE-2025-66169)	6 Jul 202608:04	–	cvelist

Vulners

Node

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-46591
camel	www.camel.apache.org/security/CVE-2026-46591.html
github	www.github.com/apache/camel/pull/23258
github	www.github.com/apache/camel/pull/23294
github	www.github.com/apache/camel/pull/23323
github	www.github.com/apache/camel/commit/7881d949c40befcc602016dcce25a2fb38d070ce
github	www.github.com/apache/camel/commit/865d0b8b99f969e06ec6275b69c72670b5763245
github	www.github.com/apache/camel/commit/bb4176fe87dc0cc60a5be37a57b69b8c610c1dd2
github	www.github.com/advisories/GHSA-4jrw-64vr-7g8m
github	www.github.com/apache/camel/releases/tag/camel-4.14.8

28 Aug 2026 19:31Current

7.2High risk

Vulners AI Score7.2

CVSS 3.18.2

EPSS0.00624

SSVC