CVE-2025-66169: Apache Camel camel-neo4j Component Cypher Injection Vulnerability
Summary
CVE-2025-66169: Apache Camel camel-neo4j component is vulnerable to cypher injection. Affects org.apache.camel:camel-neo4j across 3 version ranges.
>= 4.10.0, < 4.10.8
>= 4.14.0, < 4.14.3
>= 4.15.0, < 4.17.0
Fixed in 4.10.8, 4.14.3 or 4.17.0, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Camel is an open-source integration framework that enables developers to integrate various applications using a wide range of protocols and technologies. The camel-neo4j component specifically allows for interaction with Neo4j databases using the Cypher query language. This component is widely used in applications that require graph database capabilities. However, it has been found to be vulnerable to Cypher injection, which can lead to unauthorized data access or manipulation.
Vulnerability Detail
The Cypher Injection vulnerability in the Apache Camel camel-neo4j component arises from improper handling of user input when constructing Cypher queries. Attackers can exploit this flaw by injecting malicious Cypher code, potentially allowing them to execute arbitrary queries against the database. This could lead to data leakage, unauthorized data manipulation, or even complete compromise of the database. The vulnerability affects specific versions of the camel-neo4j component, making it crucial for users to upgrade to patched versions to mitigate risks.
How To Fix
Latest published version: 4.23.0 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 4.10.0, < 4.10.84.10.8 -
>= 4.14.0, < 4.14.34.14.3 -
>= 4.15.0, < 4.17.04.17.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate upgrading is not feasible, consider sanitizing user inputs to prevent injection attacks. Implement strict validation and escaping of any user-supplied data that will be included in Cypher queries. This can help mitigate the risk until a proper upgrade can be performed.
Conclusion
The Apache Camel camel-neo4j component is vulnerable to Cypher injection, which can lead to serious security issues if not addressed. Users are strongly advised to upgrade to the latest patched versions to protect their applications from potential exploitation. Implementing input validation can serve as a temporary measure until an upgrade is possible.
See every vulnerability recorded for org.apache.camel:camel-neo4j →
FAQ
The CVSS score of this vulnerability is 6.9, indicating a moderate severity level.
The affected versions are from 4.10.0 before 4.10.8, from 4.14.0 before 4.14.3, and from 4.15.0 before 4.17.0.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application using the Vulert playground without any signup.
Exploitation of this vulnerability could lead to unauthorized access to sensitive data, data manipulation, or complete compromise of the Neo4j database.
Yes, you can implement input validation and sanitization to prevent Cypher injection attacks until you can upgrade to a patched version.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.camel:camel-neo4j.
