Cypher Injection

🗓️ 13 Aug 2026 06:17:07Reported by Veracode Vulnerability DatabaseType

veracode🔗 sca.analysiscenter.veracode.com👁 3 Views

Apache Camel Neo4j component vulnerable to Cypher Injection via unvalidated property names in CamelNeo4jMatchProperties map, enabling arbitrary Cypher query execution against the Neo4j database.

Reporter	Title	Published	Views	Family All 10
ATTACKERKB	CVE-2026-46591	6 Jul 202608:04	–	attackerkb
BDU FSTEC	The vulnerabilities of the `deleteNode()` and `retrieveNodes()` functions in the `Neo4jProducer` class of the `camel-neo4j` component of the Apache Camel framework allow a malicious actor to gain access to read, modify, or delete any nodes and relationships.	17 Jul 202600:00	–	bdu_fstec
Circl	CVE-2026-46591	5 Jul 202620:13	–	circl
CVE	CVE-2026-46591	6 Jul 202608:04	–	cve
Cvelist	CVE-2026-46591 Apache Camel: Camel-Neo4j: JSON property names from the CamelNeo4jMatchProperties header are interpolated into the Cypher WHERE clause without validation, allowing Cypher injection (incomplete remediation of CVE-2025-66169)	6 Jul 202608:04	–	cvelist
EUVD	EUVD-2026-41835	6 Jul 202608:04	–	euvd
NVD	CVE-2026-46591	6 Jul 202609:16	–	nvd
Positive Technologies	PT-2026-55896	6 Jul 202600:00	–	ptsecurity
Snyk	Improper Neutralization of Special Elements in Data Query Logic	6 Jul 202610:35	–	snyk
Vulnrichment	CVE-2026-46591 Apache Camel: Camel-Neo4j: JSON property names from the CamelNeo4jMatchProperties header are interpolated into the Cypher WHERE clause without validation, allowing Cypher injection (incomplete remediation of CVE-2025-66169)	6 Jul 202608:04	–	vulnrichment