Neo4j Enterprise Edition和Neo4j Community Edition 安全漏洞

Neo4j Enterprise Edition and Neo4j Community Edition are both graph database products developed by the American company Neo4j. Versions of Neo4j Enterprise and Neo4j Community before 2026.01.3 and versions prior to 5.26.21 have security vulnerabilities. These vulnerabilities stem from incorrect...

PT-2026-6049

Name of the Vulnerable Software and Affected Versions Neo4j Enterprise and Community editions versions prior to 2026.01.3 and versions prior to 5.26.21 Description The obfuscate literals option in query logs does not redact error information, potentially exposing unredacted data when a query fail...

CVE-2026-1622: Insertion of Sensitive Information into Log File

Neo4j Enterprise and Community editions versions prior to 2026.01.3 and 5.26.21 are vulnerable to a potential information disclosure by a user who has ability to access the local log files. The "obfuscateliterals" option in the query logs does not redact error information, exposing unredacted dat...

CVE-2025-12738

Neo4j Enterprise edition versions prior to 2025.11.2 and 5.26.17 are vulnerable to a potential information disclosure by an attacker who has some legitimate access to the database. The vulnerability allows attacker without read access to a property to infer information about its value by trying t...

CVE-2025-12738

Neo4j Enterprise edition versions prior to 2025.11.2 and 5.26.17 are vulnerable to a potential information disclosure by an attacker who has some legitimate access to the database. The vulnerability allows attacker without read access to a property to infer information about its value by trying t...

CVE-2025-12738 Enumeration of restricted property value

Neo4j Enterprise edition versions prior to 2025.11.2 and 5.26.17 are vulnerable to a potential information disclosure by an attacker who has some legitimate access to the database. The vulnerability allows attacker without read access to a property to infer information about its value by trying t...

CVE-2025-12738 Enumeration of restricted property value

Neo4j Enterprise edition versions prior to 2025.11.2 and 5.26.17 are vulnerable to a potential information disclosure by an attacker who has some legitimate access to the database. The vulnerability allows attacker without read access to a property to infer information about its value by trying t...

CVE-2025-12738

Neo4j Enterprise editions before 2025.11.2 and 5.26.17 are vulnerable to information disclosure. An attacker with some legitimate access can infer the value of a property by enumerating possible values and observing error messages from SET property, without requiring read access. Upstream fixes a...

Neo4j Enterprise Edition security vulnerabilities

Neo4j Enterprise Edition is a graph database developed by the American company Neo4j. Versions prior to 2025.11.2 and 5.26.17 contained security vulnerabilities. These vulnerabilities allowed attackers to enumerate property values by observing error messages, potentially leading to information...

CVE-2025-12738: Exposure of Sensitive Information to an Unauthorized Actor

Neo4j Enterprise edition versions prior to 2025.11.2 and 5.26.17 are vulnerable to a potential information disclosure by an attacker who has some legitimate access to the database. The vulnerability allows attacker without read access to a property to infer information about its value by trying t...

PT-2026-3934

Neo4j Enterprise edition versions prior to 2025.11.2 and 5.26.17 are vulnerable to a potential information disclosure by an attacker who has some legitimate access to the database. The vulnerability allows attacker without read access to a property to infer information about its value by trying t...

CVE-2025-66169

A flaw was found in the Apache Camel camel-neo4j component. A remote attacker can exploit this Cypher Injection vulnerability to perform unauthorized data modification or execute arbitrary database queries. This could lead to a compromise of data integrity within the Neo4j database...

Improper Neutralization of Special Elements in Data Query Logic

Overview Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Data Query Logic via the process that handles Cypher queries. An attacker can execute arbitrary Cypher commands by injecting malicious input into the query construction process. Remediation...

GHSA-4JRW-64VR-7G8M Apache Camel camel-neo4j component is vulnerable to cypher injection

Cypher Injection vulnerability in Apache Camel camel-neo4j component. This issue affects Apache Camel: from 4.10.0 before 4.10.8, from 4.14.0 before 4.14.3, from 4.15.0 before 4.17.0 Users are recommended to upgrade to version 4.10.8 for 4.10.x LTS and 4.14.3 for 4.14.x LTS and 4.17.0...

Apache Camel camel-neo4j component is vulnerable to cypher injection

Cypher Injection vulnerability in Apache Camel camel-neo4j component. This issue affects Apache Camel: from 4.10.0 before 4.10.8, from 4.14.0 before 4.14.3, from 4.15.0 before 4.17.0 Users are recommended to upgrade to version 4.10.8 for 4.10.x LTS and 4.14.3 for 4.14.x LTS and 4.17.0...

CVE-2025-66169

Cypher Injection vulnerability in Apache Camel camel-neo4j component. This issue affects Apache Camel: from 4.10.0 before 4.10.8, from 4.14.0 before 4.14.3, from 4.15.0 before 4.17.0 Users are recommended to upgrade to version 4.10.8 for 4.10.x LTS and 4.14.3 for 4.14.x LTS and 4.17.0...

CVE-2025-66169 Apache Camel Neo4j: Cypher injection vulnerability in Camel-Neo4j component

Cypher Injection vulnerability in Apache Camel camel-neo4j component. This issue affects Apache Camel: from 4.10.0 before 4.10.8, from 4.14.0 before 4.14.3, from 4.15.0 before 4.17.0 Users are recommended to upgrade to version 4.10.8 for 4.10.x LTS and 4.14.3 for 4.14.x LTS and 4.17.0...

EUVD-2026-2447

Cypher Injection vulnerability in Apache Camel camel-neo4j component. This issue affects Apache Camel: from 4.10.0 before 4.10.8, from 4.14.0 before 4.14.3, from 4.15.0 before 4.17.0 Users are recommended to upgrade to version 4.10.8 for 4.10.x LTS and 4.14.3 for 4.14.x LTS and 4.17.0...

CVE-2025-66169

The Apache Camel camel-neo4j component is vulnerable to Cypher Injection because JSON property names from the CamelNeo4jMatchProperties header are concatenated into the Cypher WHERE clause without validation. While property values are bound as query parameters, malicious property names can alter ...

CVE-2025-66169 Apache Camel Neo4j: Cypher injection vulnerability in Camel-Neo4j component

Cypher Injection vulnerability in Apache Camel camel-neo4j component. This issue affects Apache Camel: from 4.10.0 before 4.10.8, from 4.14.0 before 4.14.3, from 4.15.0 before 4.17.0 Users are recommended to upgrade to version 4.10.8 for 4.10.x LTS and 4.14.3 for 4.14.x LTS and 4.17.0...