CVE-2026-46591 Apache Camel: Camel-Neo4j: JSON property names from the CamelNeo4jMatchProperties header are interpolated into the Cypher WHERE clause without validation, allowing Cypher injection (incomplete remediation of CVE-2025-66169)

🗓️ 06 Jul 2026 08:04:17Reported by GoogleType

osv🔗 osv.dev👁 4 Views

Camel Neo4j allows Cypher injection via property names in CamelNeo4jMatchProperties; upgrade to four point two one zero.

Reporter	Title	Published	Views	Family All 10
ATTACKERKB	CVE-2026-46591	6 Jul 202608:04	–	attackerkb
BDU FSTEC	The vulnerabilities of the `deleteNode()` and `retrieveNodes()` functions in the `Neo4jProducer` class of the `camel-neo4j` component of the Apache Camel framework allow a malicious actor to gain access to read, modify, or delete any nodes and relationships.	17 Jul 202600:00	–	bdu_fstec
Circl	CVE-2026-46591	5 Jul 202620:13	–	circl
CVE	CVE-2026-46591	6 Jul 202608:04	–	cve
Cvelist	CVE-2026-46591 Apache Camel: Camel-Neo4j: JSON property names from the CamelNeo4jMatchProperties header are interpolated into the Cypher WHERE clause without validation, allowing Cypher injection (incomplete remediation of CVE-2025-66169)	6 Jul 202608:04	–	cvelist
EUVD	EUVD-2026-41835	6 Jul 202608:04	–	euvd
NVD	CVE-2026-46591	6 Jul 202609:16	–	nvd
Positive Technologies	PT-2026-55896	6 Jul 202600:00	–	ptsecurity
Snyk	Improper Neutralization of Special Elements in Data Query Logic	6 Jul 202610:35	–	snyk
Vulnrichment	CVE-2026-46591 Apache Camel: Camel-Neo4j: JSON property names from the CamelNeo4jMatchProperties header are interpolated into the Cypher WHERE clause without validation, allowing Cypher injection (incomplete remediation of CVE-2025-66169)	6 Jul 202608:04	–	vulnrichment

Source	Link
repo	www.repo.maven.apache.org/maven2
camel	www.camel.apache.org/security/CVE-2026-46591.html
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2026/46xxx/CVE-2026-46591.json
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-46591

15 Jul 2026 01:49Current

6.2Medium risk

Vulners AI Score6.2

CVSS 3.18.2

EPSS0.00329