CVE-2026-46591

camel-neo4j Cypher Injection Reproducer CVE-2026-46591 This project demonstrates a Cypher injection in Apache Camel's camel-neo4j component, tracked as CVE-2026-46591. The producer builds the Cypher WHERE clause for its match/retrieve and delete operations from the CamelNeo4jMatchProperties map...

camel-neo4j deleteNode retrieveNodes Node Modification

The vulnerability of the deleteNode and retrieveNodes functions in the Neo4jProducer class of the camel-neo4j framework from Apache Camel is related to improper elimination of special elements in data queries. Exploiting this vulnerability could allow an attacker to gain access to read, modify, o...

org.apache.camel.karaf:camel-neo4j (>=4.10.3, <=4.14.7), org.apache.camel.springboot:camel-neo4j-starter (>=4.10.0, <=4.14.7) potentially affected by CVE-2026-46591 via org.apache.camel:camel-neo4j (>=4.10.0, <=4.14.7)

org.apache.camel:camel-neo4j MAVEN version =4.10.0, =4.10.3, =4.10.0, =4.14.7 Source cves: CVE-2026-46591 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-17879234...

org.apache.camel.karaf:camel-neo4j (>=4.18.1, <=4.18.2), org.apache.camel.springboot:camel-neo4j-starter (>=4.15.0, <=4.18.2) potentially affected by CVE-2026-46591 via org.apache.camel:camel-neo4j (>=4.15.0, <=4.18.2)

org.apache.camel:camel-neo4j MAVEN version =4.15.0, =4.18.1, =4.15.0, =4.18.2 Source cves: CVE-2026-46591 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-17879234...

org.apache.camel.springboot:camel-neo4j-starter (>=4.19.0, <=4.20.0) potentially affected by CVE-2026-46591 via org.apache.camel:camel-neo4j (>=4.19.0, <=4.20.0)

org.apache.camel:camel-neo4j MAVEN version =4.19.0, =4.19.0, =4.20.0 Source cves: CVE-2026-46591 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-17879234...

Improper Neutralization of Special Elements in Data Query Logic

Overview Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Data Query Logic in the Neo4jProducer.retrieveNodes and deleteNode processes when JSON property names from the CamelNeo4jMatchProperties header are interpolated into the Cypher WHERE clause...

org.apache.camel.karaf:camel-neo4j (>=4.10.3, <=4.14.7), org.apache.camel.springboot:camel-neo4j-starter (>=4.10.0, <=4.14.7) potentially affected by CVE-2025-66169 +1 more via org.apache.camel:camel-neo4j (>=4.10.0, <=4.14.7)

org.apache.camel:camel-neo4j MAVEN version =4.10.0, =4.10.3, =4.10.0, =4.14.7 Source cves: CVE-2025-66169, CVE-2026-46591 Source advisory: OSV:GHSA-Q86M-QJPM-VQCW...

org.apache.camel.karaf:camel-neo4j (>=4.10.3, <=4.14.7), org.apache.camel.springboot:camel-neo4j-starter (>=4.10.0, <=4.14.7) potentially affected by CVE-2025-66169 +1 more via org.apache.camel:camel-neo4j (>=4.10.0, <=4.14.7)

org.apache.camel:camel-neo4j MAVEN version =4.10.0, =4.10.3, =4.10.0, =4.14.7 Source cves: CVE-2025-66169, CVE-2026-46591 Source advisory: GHSA-Q86M-QJPM-VQCW...

org.apache.camel.karaf:camel-neo4j (>=4.18.1, <=4.18.2), org.apache.camel.springboot:camel-neo4j-starter (>=4.15.0, <=4.18.2) potentially affected by CVE-2025-66169 +1 more via org.apache.camel:camel-neo4j (>=4.15.0, <=4.18.2)

org.apache.camel:camel-neo4j MAVEN version =4.15.0, =4.18.1, =4.15.0, =4.18.2 Source cves: CVE-2025-66169, CVE-2026-46591 Source advisory: OSV:GHSA-Q86M-QJPM-VQCW...

org.apache.camel.karaf:camel-neo4j (>=4.18.1, <=4.18.2), org.apache.camel.springboot:camel-neo4j-starter (>=4.15.0, <=4.18.2) potentially affected by CVE-2025-66169 +1 more via org.apache.camel:camel-neo4j (>=4.15.0, <=4.18.2)

org.apache.camel:camel-neo4j MAVEN version =4.15.0, =4.18.1, =4.15.0, =4.18.2 Source cves: CVE-2025-66169, CVE-2026-46591 Source advisory: GHSA-Q86M-QJPM-VQCW...

org.apache.camel.springboot:camel-neo4j-starter (>=4.19.0, <=4.20.0) potentially affected by CVE-2025-66169 +1 more via org.apache.camel:camel-neo4j (>=4.19.0, <=4.20.0)

org.apache.camel:camel-neo4j MAVEN version =4.19.0, =4.19.0, =4.20.0 Source cves: CVE-2025-66169, CVE-2026-46591 Source advisory: OSV:GHSA-Q86M-QJPM-VQCW...

org.apache.camel.springboot:camel-neo4j-starter (>=4.19.0, <=4.20.0) potentially affected by CVE-2025-66169 +1 more via org.apache.camel:camel-neo4j (>=4.19.0, <=4.20.0)

org.apache.camel:camel-neo4j MAVEN version =4.19.0, =4.19.0, =4.20.0 Source cves: CVE-2025-66169, CVE-2026-46591 Source advisory: GHSA-Q86M-QJPM-VQCW...

GHSA-Q86M-QJPM-VQCW Apache Camel-Neo4j: JSON property names from the CamelNeo4jMatchProperties header are interpolated into the Cypher WHERE clause without validation, allowing Cypher injection (incomplete remediation of CVE-2025-66169)

Improper Neutralization of Special Elements in Data Query Logic vulnerability in Apache Camel Neo4j component. The camel-neo4j producer builds the Cypher WHERE clause for its match/retrieve and delete operations from the CamelNeo4jMatchProperties map. CVE-2025-66169 addressed Cypher injection...

Apache Camel-Neo4j: JSON property names from the CamelNeo4jMatchProperties header are interpolated into the Cypher WHERE clause without validation, allowing Cypher injection (incomplete remediation of CVE-2025-66169)

Improper Neutralization of Special Elements in Data Query Logic vulnerability in Apache Camel Neo4j component. The camel-neo4j producer builds the Cypher WHERE clause for its match/retrieve and delete operations from the CamelNeo4jMatchProperties map. CVE-2025-66169 addressed Cypher injection...

CVE-2026-46591

Improper Neutralization of Special Elements in Data Query Logic vulnerability in Apache Camel Neo4J component. The camel-neo4j producer builds the Cypher WHERE clause for its match/retrieve and delete operations from the CamelNeo4jMatchProperties map. CVE-2025-66169 addressed Cypher injection...

CVE-2026-46591

Improper Neutralization of Special Elements in Data Query Logic vulnerability in Apache Camel Neo4J component. The camel-neo4j producer builds the Cypher WHERE clause for its match/retrieve and delete operations from the CamelNeo4jMatchProperties map. CVE-2025-66169 addressed Cypher injection...

org.apache.camel.karaf:camel-neo4j (>=4.10.3, <=4.14.7), org.apache.camel.springboot:camel-neo4j-starter (>=4.10.0, <=4.14.7) potentially affected by CVE-2026-46591 via org.apache.camel:camel-neo4j (>=4.10.0, <=4.14.7)

org.apache.camel:camel-neo4j MAVEN version =4.10.0, =4.10.3, =4.10.0, =4.14.7 Source cves: CVE-2026-46591 Source advisory: MEND:CVE-2026-46591...

org.apache.camel.karaf:camel-neo4j (>=4.18.1, <=4.18.2), org.apache.camel.springboot:camel-neo4j-starter (>=4.15.0, <=4.18.2) potentially affected by CVE-2026-46591 via org.apache.camel:camel-neo4j (>=4.15.0, <=4.18.2)

org.apache.camel:camel-neo4j MAVEN version =4.15.0, =4.18.1, =4.15.0, =4.18.2 Source cves: CVE-2026-46591 Source advisory: MEND:CVE-2026-46591...

org.apache.camel.springboot:camel-neo4j-starter (>=4.19.0, <=4.20.0) potentially affected by CVE-2026-46591 via org.apache.camel:camel-neo4j (>=4.19.0, <=4.20.0)

org.apache.camel:camel-neo4j MAVEN version =4.19.0, =4.19.0, =4.20.0 Source cves: CVE-2026-46591 Source advisory: MEND:CVE-2026-46591...

CVE-2026-46591 Apache Camel: Camel-Neo4j: JSON property names from the CamelNeo4jMatchProperties header are interpolated into the Cypher WHERE clause without validation, allowing Cypher injection (incomplete remediation of CVE-2025-66169)

Improper Neutralization of Special Elements in Data Query Logic vulnerability in Apache Camel Neo4J component. The camel-neo4j producer builds the Cypher WHERE clause for its match/retrieve and delete operations from the CamelNeo4jMatchProperties map. CVE-2025-66169 addressed Cypher injection...