CVE-2026-92681 is a critical vulnerability in @neo4j/graphql versions from 3.23.0 up to 7.6.3. It involves missing authentication enforcement for top-level fields annotated with @cypher when @authentication directives are applied at the schema or type level. This flaw allows unauthenticated users to invoke these fields and execute Cypher statements with the privileges of the GraphQL service account, potentially leading to unauthorized data reading and modification. The issue is fixed in version 7.6.4.
CVE-2026-92682 is an authorization vulnerability in @neo4j/graphql versions 7.0.0 up to but not including 7.6.4. The issue arises because the 'none' quantifier in @authorization filters on relationships and connections is not properly negated when translated to Cypher queries, causing it to behave like 'some'. This flaw allows authenticated users who should be denied access to read, create, or delete sensitive data. The vulnerability is fixed in version 7.6.4.
CVE-2026-19869 is an authorization bypass vulnerability in the neo4j/graphql library affecting versions 5.2.0 through 5.12.14, 6.0.0 through 6.6.4, and 7.0.0 through 7.5.9. The flaw occurs when both type-level and field-level @authentication rules are defined on the same operation type; only the type-level rule is enforced, causing stricter field-level rules to be ignored. This allows users with a valid token meeting the broader type-level requirements but lacking stricter field-level permissions (e.g., admin role) to access restricted fields. No token forgery is involved, but legitimate non-admin tokens can bypass intended restrictions. The vulnerability has a CVSS 4.0 score of 7.6 (high severity).
The @neo4j/graphql library versions prior to 7.5.6 and 5.12.14 have an authentication bypass vulnerability. The library fails to verify the authenticity of a client-supplied, pre-decoded JWT object passed through GraphQL subscription connectionParams. This allows unauthenticated remote clients to forge arbitrary JWT claims and be accepted as authenticated identities, enabling unauthorized access to subscription events restricted to specific roles or users. Versions 6.x are end-of-life and will not receive a fix.
Neo4j's Bolt modern handshake decoder treats an overlong capability bit mask the same way it treats a truncated bit mask. When an unauthenticated client sends a selected protocol version followed by 32 continuation bytes in the capability mask, the decoder resets the reader index and waits for more bytes instead of rejecting the protocol message and closing the channel.
Because the same unread bytes remain at the front of the decoder buffer, appending a terminating byte later does not recover the connection. The decoder re-reads the same first 32 continuation bytes, returns without producing a handshake-finalization message, and leaves the channel open.
This can be triggered before authentication by any client that can reach the Bolt connector.
mcp-neo4j-cypher is an MCP server for executing Cypher queries against Neo4j databases. In versions prior to 0.6.0, the read_only mode enforcement can be bypassed using APOC CALL procedures, potentially allowing unauthorized write operations or server-side request forgery. This issue is fixed in version 0.6.0.
CVE-2026-1471 is an authorization vulnerability in Neo4j Enterprise edition prior to version 2026.01.4. It arises from excessive caching of authentication context in certain non-default Single Sign-On (SSO) configurations using the UserInfo endpoint. Authenticated users may inherit the authentication context of the first user who logged in after a server restart, potentially allowing unauthorized access to resources. The issue affects versions 2025.01 and 4.4.0 and requires user interaction and some privileges to exploit. The vulnerability has a low CVSS score (2.
An edgecase in SSO implementation in Neo4j Enterprise edition versions prior to version 2026.02 can lead to unauthorised access under the following conditions:
If a neo4j admin configures two or more OIDC providers AND configures one or more of them to be an authorization provider AND configures one or more of them to be authentication-only, then those that are authentication-only will also provide authorization. This edgecase becomes a security problem only if the authentication-only provider contains groups which have higher privileges than provided by the intended (configured) authorization provider.
When using multiple plugins for authentication and authorisation, prior to the fix the issue could lead to a plugin configured to provide only authentication or authorisation capabilities erroneously providing both capabilities.
We recommend upgrading to versions 2026.02 (or 5.26.22) where the issue is fixed.
Incorrect resolving of namespaces in composite databases in Neo4j Enterprise edition prior to versions 2026.02 and 5.26.22 can lead to the following scenario:
an admin that intends to give a user an access to a remote database constituent "namespace.name" will inadvertently grant access to any local database or remote alias called "name". If such database or alias doesn't exist when the command is run, the privileges will apply if it's created in the future.
Insufficient escaping of unicode characters in query log in Neo4j Enterprise and Community editions prior to 2026.01 can lead to XSS if the user opens the logs in a tool that treats them as HTML. There is no security impact on Neo4j products, but this advisory is released as a precaution to treat the logs as plain text if using versions prior to 2026.01.
Proof of concept exploit: https://github.com/JoakimBulow/CVE-2026-1337
CVE-2026-1622 is a medium severity vulnerability in Neo4j Enterprise and Community editions prior to versions 2026.01.3 and 5.26.21. It involves the insertion of sensitive information into query log files due to incomplete obfuscation of error messages when the 'obfuscate_literals' option is enabled. A user with legitimate access to local log files and the ability to run queries that trigger errors can infer unauthorized information from unredacted error details. The vulnerability does not require user interaction but does require local log file access and some privileges to run queries. The issue is fixed in the specified patched versions, and a new configuration option 'db.logs.
Neo4j Enterprise edition versions prior to 2025.11.2 and 5.26.17 are vulnerable to a potential information disclosure by an attacker who has some legitimate access to the database. The vulnerability allows attacker without read access to a property to infer information about its value by trying to enumerate all possible values through observing error messages of SET property.
We recommend upgrading to 2025.11.2 or 5.26.17 and above, where the issues is fixed.
Potential information leak in bolt protocol handshake in Neo4j Enterprise and Community editions allows attacker to obtain one byte of information from previous connections. The attacker has no control over the information leaked in server responses.
DNS rebinding vulnerability in Neo4j Cypher MCP server allows malicious websites to bypass Same-Origin Policy protections and execute unauthorised tool invocations against locally running Neo4j MCP instances. The attack relies on the user being enticed to visit a malicious website and spend sufficient time there for DNS rebinding to succeed.