Cypher Injection in Apache Camel Neo4j Component

Executive Summary

CVE-2026-46591 is a security vulnerability in the Apache Camel camel-neo4j component involving improper neutralization of special elements in data query logic.

The vulnerability arises because the camel-neo4j producer builds Cypher WHERE clauses by directly concatenating JSON property names from the CamelNeo4jMatchProperties map into the query string without validation.

If an attacker can control these property names (the JSON keys), they can inject arbitrary Cypher code, which can alter the structure of the query and allow them to read, modify, or delete any node or relationship in the Neo4j database.

This issue is an incomplete fix of a previous vulnerability (CVE-2025-66169) that addressed injection in property values but not property names.

The vulnerability affects Apache Camel versions from 4.10.0 to 4.14.7, 4.15.0 to 4.18.2, and 4.19.0 to 4.20.0.

The fix involves validating property names against a strict regex pattern to prevent injection.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker who controls untrusted input mapped into the CamelNeo4jMatchProperties header to inject arbitrary Cypher queries.

As a result, the attacker can read, modify, or delete any node or relationship in the Neo4j database, potentially leading to data breaches, data loss, or unauthorized data manipulation.

The vulnerability is reachable if routes in Apache Camel carry untrusted data into the CamelNeo4jMatchProperties header, especially if inbound Camel headers are not properly filtered.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by inspecting whether untrusted input is mapped into the CamelNeo4jMatchProperties header in Apache Camel routes, especially if the property names (JSON keys) are not validated and are directly concatenated into Cypher queries.

To detect potential exploitation or presence of this vulnerability, you can check your Apache Camel version to see if it falls within the affected ranges (4.10.0 to 4.14.7, 4.15.0 to 4.18.2, and 4.19.0 to 4.20.0).

You can also audit your Camel routes and logs for usage of the CamelNeo4jMatchProperties header and verify if property names are validated against the regex ^[A-Za-z_][A-Za-z0-9_]*$.

Suggested commands include:

• Check Apache Camel version: `camel --version` or check your application's dependency versions.
• Search your route definitions or source code for usage of CamelNeo4jMatchProperties header.
• Review logs for suspicious Cypher queries or errors related to IllegalArgumentException triggered by invalid property names.
• If possible, enable debugging or tracing in Apache Camel to monitor headers and query construction.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate recommended mitigation is to upgrade Apache Camel to a fixed version: 4.14.8, 4.18.3, or 4.21.0 depending on your release stream.

If upgrading immediately is not possible, do not populate the CamelNeo4jMatchProperties map from untrusted input.

Validate or allow-list the property names before they reach the Neo4j producer, for example by enforcing the regex pattern ^[A-Za-z_][A-Za-z0-9_]*$.

Ensure that any consumer feeding such a route filters inbound Camel* or camel* headers so that the CamelNeo4jMatchProperties header cannot be supplied by an external sender.

Useful 0 Not Useful 0