Executive brief
Neo4j is a graph database used to store and query connected data. An authenticated database user can inject malicious log entries into Neo4j's query log by sending specially crafted transaction metadata, making the logs appear to contain queries that were never actually executed. This could allow an attacker to forge evidence in audit logs, misleading administrators and security teams about what queries ran on the database.
Technical details
The vulnerability is a log injection flaw in the Neo4j query log handler. The root cause is insufficient escaping of control characters (specifically newline characters) in the transaction metadata field when logs are written in plain-text format (not JSON). An authenticated user can craft a transaction with metadata containing newline characters, causing the metadata to break out of its log line and inject fake query entries that appear legitimate. The attack requires database authentication and can only occur when Neo4j is not configured to output logs in JSON format. The injected entries do not execute as queries but corrupt the log audit trail. Patching is available in Neo4j version 2026.01 and later.
Affected products
- Neo4j Neo4j Community prior to 2026.01
- Neo4j Neo4j Enterprise prior to 2026.01
Timeline
- 2026-02-06: disclosed: Vulnerability published