CVE-2026-46591: Apache Camel-Neo4j Cypher Injection Vulnerability
Summary
CVE-2026-46591: Improper Neutralization of Special Elements in Data Query Logic vulnerability in Apache Camel Neo4j component. Affects org.apache.camel:camel-neo4j across 3 version ranges.
>= 4.10.0, < 4.14.8
>= 4.15.0, < 4.18.3
>= 4.19.0, < 4.21.0
Fixed in 4.14.8, 4.18.3 or 4.21.0, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Camel is an open-source integration framework that allows developers to integrate various applications using a wide range of protocols and technologies. The Camel Neo4j component enables interaction with Neo4j databases, allowing users to perform operations like match, retrieve, and delete nodes. However, this component has a vulnerability that can lead to Cypher injection attacks, compromising the integrity of the database.
Vulnerability Detail
The vulnerability arises from improper neutralization of special elements in data query logic within the Apache Camel Neo4j component. Specifically, the CamelNeo4jMatchProperties header allows JSON property names to be interpolated into the Cypher WHERE clause without validation. This means that an attacker can manipulate the property names to inject arbitrary Cypher commands, potentially allowing unauthorized access to read, modify, or delete nodes and relationships in the Neo4j database. This issue is a continuation of the incomplete remediation of CVE-2025-66169, which previously addressed property values but not property names.
How To Fix
Latest published version: 4.23.0 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 4.10.0, < 4.14.84.14.8 -
>= 4.15.0, < 4.18.34.18.3 -
>= 4.19.0, < 4.21.04.21.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate upgrading is not feasible, users should avoid populating the CamelNeo4jMatchProperties map with untrusted input. It is recommended to validate or allow-list property names against a regex pattern such as ^[A-Za-z_][A-Za-z0-9_]$ before passing them to the Neo4j producer. Additionally, ensure that any consumers feeding data into this route filter inbound Camel or camel* headers to prevent external manipulation.
Conclusion
The CVE-2026-46591 vulnerability in the Apache Camel Neo4j component poses a significant risk due to the potential for Cypher injection attacks. Users are strongly advised to upgrade to the latest patched versions or implement the recommended workarounds to mitigate this risk.
See every vulnerability recorded for org.apache.camel:camel-neo4j →
FAQ
CVE-2026-46591 is a vulnerability in the Apache Camel Neo4j component that allows Cypher injection through unvalidated JSON property names.
An attacker can exploit this vulnerability to inject arbitrary Cypher commands, potentially gaining unauthorized access to modify or delete data in your Neo4j database.
The vulnerability affects Apache Camel versions from 4.10.0 before 4.14.8, from 4.15.0 before 4.18.3, and from 4.19.0 before 4.21.0.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application against this vulnerability using the Vulert playground without any signup.
The CVSS score of this vulnerability is 8.2, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.camel:camel-neo4j.
