CVE-2026-1622: Neo4j Information Disclosure Vulnerability in Query Logs
Summary
CVE-2026-1622: Neo4j Enterprise and Community vulnerable to a potential information disclosure. Affects org.neo4j:neo4j across 2 version ranges.
< 5.26.21
>= 2025.01.0, < 2026.01.3
Fixed in 5.26.21 or 2026.01.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Neo4j is a popular open-source graph database management system that provides a robust platform for storing and querying graph data. It is widely used for applications that require complex relationships and real-time data processing. The Neo4j Enterprise and Community editions are designed to handle large datasets and provide features such as ACID compliance, high availability, and scalability. However, certain versions of Neo4j are vulnerable to an information disclosure issue that can expose sensitive data through unredacted error messages in query logs.
Vulnerability Detail
The vulnerability arises from the 'obfuscate_literals' option in Neo4j's query logging system, which fails to redact error information. When a user executes a query that results in an error, the unredacted data is logged, potentially exposing sensitive information to users who have access to the local log files. This can lead to unauthorized access to information that the user should not see, especially if they can trigger errors through their queries. The issue affects versions prior to 2026.01.3 and 5.26.21.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 5.26.215.26.21 -
>= 2025.01.0, < 2026.01.32026.01.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If users wish to maintain obfuscation of error messages in their query logs, they should enable the new configuration setting 'db.logs.query.obfuscate_errors' after upgrading Neo4j. This can be done by adding the following line to the Neo4j configuration file:
db.logs.query.obfuscate_errors=true
Conclusion
In summary, CVE-2026-1622 is a significant vulnerability in Neo4j that can lead to unauthorized information disclosure through query logs. Users are strongly advised to upgrade to the latest versions and implement the recommended configuration changes to secure their installations.
See every vulnerability recorded for org.neo4j:neo4j →
FAQ
CVE-2026-1622 is a vulnerability in Neo4j that allows for potential information disclosure through unredacted error messages in query logs.
The vulnerability affects Neo4j Enterprise and Community editions prior to versions 2026.01.3 and 5.26.21.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software by analyzing the pom.xml file. You can also check your application using the Vulert playground without signup.
The CVSS score of this vulnerability is 4.8, indicating a moderate severity level.
Upgrade to the patched versions of Neo4j (2026.01.3 or 5.26.21) and review your query log file permissions to restrict access.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.neo4j:neo4j.
