neo4j vulnerabilities

Products

• neo4j 9
• Enterprise Edition 8
• @neo4j/graphql 6
• Community Edition 4
• awesome procedures on cyper 3
• apoc 1
• awesome procedures 1
• awesome procedures on cypher 1
• graph databse 1

Latest neo4j CVEs

Newest publication first

1. CVE-2026-92684 Aggregation queries can bypass authentication restrictions in @neo4j/graphql

   Published 2026-11-10

   High·CVSS 8.7 EPSS 0.40%

   Missing Authentication for Critical Function in aggregation queries in Neo4j @neo4j/graphql 5.0.0 before 5.12.17 and 7.0.0 before 7.6.8 allows remote attackers to read protected data via GraphQL aggregation queries. Field-level @authentication is not enforced on string aggregates...

2. CVE-2026-92683 Incomplete evaluation of multi-condition JWT where filter in @authentication in @neo4j/graphql

   Published 2026-11-09

   High·CVSS 8.6 EPSS 0.48%

   Incorrect authorization in the @authentication directive JWT where filter evaluation in Neo4j @neo4j/graphql versions 7.0.0 before 7.6.7 allows an attacker holding an otherwise-valid JWT to bypass all but the first filter condition via a multi-condition jwt where filter written i...

3. CVE-2026-92681 @neo4j/graphql: schema-level and type-level @authentication not enforced on top-level @cypher fields

   Published 2026-10-12

   Critical·CVSS 9.3 EPSS 0.37%

   In @neo4j/graphql versions up to and including 7.6.3, @authentication directives applied at the schema level or on the Query or Mutation types are silently ignored for top-level fields annotated with @cypher. Only @authentication directives placed directly on the individual field...

4. CVE-2026-92682 @neo4j/graphql: authorization relationship and connection filters invert the "none" quantifier

   Published 2026-10-12

   High·CVSS 8.6 EPSS 0.31%

   In @neo4j/graphql versions from 7.0.0 up to but not including 7.6.4, the none quantifier in @authorization filters on relationships and connections is not negated when translated to Cypher, so it behaves like some. A rule such as "none of the related denied users matches the JWT...

5. CVE-2026-19869 Privilege Escalation via Dropped Field-Level @authentication

   Published 2026-08-18

   High·CVSS 7.6 EPSS 0.49%

   @neo4j/graphql from 5.2.0 until the patched versions fails to enforce field-level @authentication rules on root custom-resolver fields when a type-level @authentication rule is also present on the same operation type. When both a type-level @authentication (on Query/Mutation) and...

6. CVE-2026-5423 Subscription Authentication Bypass via Unverified connectionParams.jwt

   Published 2026-08-06

   High·CVSS 8.2 EPSS 0.59%

   @neo4j/graphql library versions prior to 7.5.6 fail to verify the authenticity of a client-supplied, pre-decoded JWT object passed through GraphQL subscription connectionParams. As a result, any unauthenticated remote client that can open a GraphQL-over-WebSocket connection can f...

7. CVE-2026-14587 Unathenticated connection can hold Bolt channel open

   Published 2026-08-05

   Medium·CVSS 5.5 EPSS 0.54%

   Neo4j's Bolt modern handshake decoder treats an overlong capability bit mask the same way it treats a truncated bit mask. When an unauthenticated client sends a selected protocol version followed by 32 continuation bytes in the capability mask, the decoder resets the reader index...

8. CVE-2026-1471 Caching of authentication context

   Published 2026-03-11

   Low·CVSS 2.1 EPSS 0.28%

   Excessive caching of authentication context in Neo4j Enterprise edition versions prior to 2026.01.4 leads to authenticated users inheriting the context of the first user who authenticated after restart. The issue is limited to certain non-default configurations of SSO (UserInfo e...

9. CVE-2026-1524 Auth misconfiguration when multiple providers enabled

   Published 2026-03-11

   Low·CVSS 2.1 EPSS 0.37%

   An edgecase in SSO implementation in Neo4j Enterprise edition versions prior to version 2026.02 can lead to unauthorised access under the following conditions: If a neo4j admin configures two or more OIDC providers AND configures one or more of them to be an authorization provide...

10. CVE-2026-1497 Incorrect privilege assignment in composite databases

    Published 2026-03-11

    Low·CVSS 2.0 EPSS 0.27%

    Incorrect resolving of namespaces in composite databases in Neo4j Enterprise edition prior to versions 2026.02 and 5.26.22 can lead to the following scenario: an admin that intends to give a user an access to a remote database constituent "namespace.name" will inadvertently grant...

11. CVE-2026-1337 Insufficient escaping of unicode characters in query log

    Published 2026-02-06

    Low·CVSS 1.1 EPSS 0.25% PoC

    Insufficient escaping of unicode characters in query log in Neo4j Enterprise and Community editions prior to 2026.01 can lead to XSS if the user opens the logs in a tool that treats them as HTML. There is no security impact on Neo4j products, but this advisory is released as a pr...

12. CVE-2026-1622 Unredacted data exposure in query.log

    Published 2026-02-04

    Medium·CVSS 4.8 EPSS 0.16%

    Neo4j Enterprise and Community editions versions prior to 2026.01.3 and 5.26.21 are vulnerable to a potential information disclosure by a user who has ability to access the local log files. The "obfuscate_literals" option in the query logs does not redact error information, expos...

13. CVE-2025-12738 Enumeration of restricted property value

    Published 2026-01-22

    Low·CVSS 1.3 EPSS 0.39%

    Neo4j Enterprise edition versions prior to 2025.11.2 and 5.26.17 are vulnerable to a potential information disclosure by an attacker who has some legitimate access to the database. The vulnerability allows attacker without read access to a property to infer information about its...

14. CVE-2025-11602 Untargeted information leak in Bolt protocol handshake

    Published 2025-10-31

    Medium·CVSS 6.3 EPSS 0.32%

    Potential information leak in bolt protocol handshake in Neo4j Enterprise and Community editions allows attacker to obtain one byte of information from previous connections. The attacker has no control over the information leaked in server responses.

15. CVE-2024-34517 Neo4j Cypher component mishandles IMMUTABLE privileges

    Published 2024-05-07

    Medium·CVSS 6.5 EPSS 0.63%

    The Cypher component in Neo4j 5.0.0 through 5.18 mishandles IMMUTABLE privileges in some situations where an attacker already has admin access.

16. CVE-2023-23926 XML External Entity (XXE) vulnerability in apoc.import.graphml

    Published 2023-02-16

    High·CVSS 8.1 EPSS 0.89%

    APOC (Awesome Procedures on Cypher) is an add-on library for Neo4j. An XML External Entity (XXE) vulnerability found in the apoc.import.graphml procedure of APOC core plugin prior to version 5.5.0 and 4.4.0.14 (4.4 branch) in Neo4j graph database. XML External Entity (XXE) inject...

17. CVE-2022-23532 neo4j-apoc-procedures is vulnerable to path traversal

    Published 2023-01-14

    Medium·CVSS 6.5 EPSS 0.72%

    APOC (Awesome Procedures on Cypher) is an add-on library for Neo4j that provides hundreds of procedures and functions. A path traversal vulnerability found in the apoc.export.* procedures of apoc plugins in Neo4j Graph database. The issue allows a malicious actor to potentially b...

18. CVE-2022-37423 Neo4j Graph apoc plugins Partial Path Traversal Vulnerability

    Published 2022-08-12

    High·CVSS 7.5 EPSS 1.5%

    Neo4j APOC (Awesome Procedures on Cypher) before 4.3.0.7 and 4.x before 4.4.0.8 allows Directory Traversal to sibling directories via apoc.log.stream.

19. CVE-2021-42767 Neo4j Graph Database vulnerable to Path Traversal

    Published 2022-03-01

    Critical·CVSS 9.1 EPSS 1.5%

    A directory traversal vulnerability in the apoc plugins in Neo4J Graph database before 4.4.0.1 allows attackers to read local files, and sometimes create local files. This is fixed in 3.5.17, 4.2.10, 4.3.0.4, and 4.4.0.1.

20. CVE-2021-34371 Deserialization of Untrusted Data in Neo4j

    Published 2021-08-05

    Critical·CVSS 9.8 EPSS 13.4% Public exploit

    Neo4j through 3.4.18 (with the shell server enabled) exposes an RMI service that arbitrarily deserializes Java objects, e.g., through setSessionVariable. An attacker can abuse this for remote code execution because there are dependencies with exploitable gadget chains.

21. CVE-2021-34802 Improper Privilege Management in Neo4j Graph Database

    Published 2021-07-27

    High·CVSS 8.8 EPSS 1.0%

    A failure in resetting the security context in some transaction actions in Neo4j Graph Database 4.2 and 4.3 could allow authenticated users to execute commands with elevated privileges.

22. CVE-2018-1000820 XML External Entity (XXE) vulnerability in neo4j.procedure:apoc

    Published 2018-12-20

    Critical·CVSS 10.0 EPSS 1.9%

    neo4j-contrib neo4j-apoc-procedures version before commit 45bc09c contains a XML External Entity (XXE) vulnerability in XML Parser that can result in Disclosure of confidential data, denial of service, SSRF, port scanning. This vulnerability appears to have been fixed in after co...

23. CVE-2018-18389 Incorrect access control in Neo4j Enterprise Database Server via LDAP authentication

    Published 2018-10-16

    Critical·CVSS 9.8 EPSS 1.9%

    Due to incorrect access control in Neo4j Enterprise Database Server 3.4.x before 3.4.9, the setting of LDAP for authentication with STARTTLS, and System Account for authorization, allows an attacker to log into the server by sending any valid username with an arbitrary password.

24. CVE-2013-7259 Neo4J vulnerable to Cross-Site Request Forgery

    Published 2014-04-29

    Medium·CVSS 6.8 EPSS 1.3%

    Multiple cross-site request forgery (CSRF) vulnerabilities in Neo4J 1.9.2 allow remote attackers to hijack the authentication of administrators for requests that execute arbitrary code, as demonstrated by a request to (1) db/data/ext/GremlinPlugin/graphdb/execute_script or (2) db...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.