Listen to this Post
The CVE refers to a Cypher Injection vulnerability in the Apache Camel camel-neo4j component. Cypher is the query language for the Neo4j graph database. In affected versions, the camel-neo4j component does not properly sanitize user input before incorporating it into Cypher queries. This allows an attacker to inject malicious Cypher clauses through parameters in message headers, body, or endpoints. For example, if an application constructs dynamic queries by concatenating user-supplied strings, an attacker could inject commands like WHERE, SET, DELETE, or `MATCH` to manipulate query logic. This can lead to unauthorized data access, data corruption, or full database compromise. The vulnerability arises from the use of string concatenation instead of parameterized queries or prepared statements. It affects Camel versions from 4.10.0 before 4.10.8, from 4.14.0 before 4.14.3, and from 4.15.0 before 4.17.0. The injection can occur when routes pass untrusted data directly to neo4j operations. Patches in versions 4.10.8, 4.14.3, and 4.17.0 fix this by implementing proper input validation and using parameterized queries. Users must upgrade to these versions to mitigate the risk. Exploitation requires access to endpoints that process user input for neo4j queries. The severity is moderate due to the potential for data breaches but requires specific configuration for attack.
Platform: Apache Camel neo4j
Version: Multiple versions affected
Vulnerability: Cypher Injection
Severity: Moderate
date: Jan 14 2026
Prediction: Jan 14 2026
What Undercode Say:
Analytics
Check Apache Camel version
./mvnw dependency:tree | grep camel-neo4j
Sample vulnerable route code snippet
from("direct:start")
.to("neo4j:bolt://localhost?query=MATCH (n) WHERE n.name = '" + header("input") + "' RETURN n")
Command to upgrade Camel version
./mvnw versions:use-latest-versions -Dincludes=org.apache.camel:camel-neo4j
How Exploit:
Attacker sends crafted input with Cypher injection payloads, such as `’ OR ‘1’=’1` or ' DELETE n, through message headers or body to manipulate queries, potentially extracting or deleting data.
Protection from this CVE
Upgrade to patched versions: 4.10.8, 4.14.3, or 4.17.0. Use parameterized queries instead of string concatenation. Validate and sanitize all user inputs.
Impact:
Unauthorized data access, data manipulation, or database compromise via injected Cypher commands.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
