# CVE-2026-1337: Neo4j Enterprise and Community log injection via unescaped metadata

Source: https://junglewise.ai/threats/cve-2026-1337-neo4j-enterprise-and-community-log-injection-via-unescaped  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-02-06. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-1337 · Severity: medium · CVSS 5.4 · Published 2026-02-06

Neo4j is a graph database used to store and query connected data. An authenticated database user can inject malicious log entries into Neo4j's query log by sending specially crafted transaction metadata, making the logs appear to contain queries that were never actually executed. This could allow an attacker to forge evidence in audit logs, misleading administrators and security teams about what queries ran on the database.

Technologies: [org.neo4j:neo4j (Maven)](https://junglewise.ai/threats/technologies/org-neo4j-neo4j). Vendors: [Maven](https://junglewise.ai/threats/vendors/maven), [Neo4j](https://junglewise.ai/threats/vendors/neo4j).

## Quick answers

**Is CVE-2026-1337 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-1337 being exploited in the wild.

**How severe is CVE-2026-1337?** Medium severity, with a CVSS score of 5.4, published 6 February 2026.

**Which products and versions are affected?** org.neo4j:neo4j (Maven) ECOSYSTEM:introduced=0,fixed=2026.01; Neo4j Community prior to 2026.01; Neo4j Enterprise prior to 2026.01.

**Is there a fix for CVE-2026-1337?** Yes. org.neo4j:neo4j (Maven): upgrade to 2026.01 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-1337 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-1337?** Check whether you run org.neo4j:neo4j (Maven), Neo4j Community or Neo4j Enterprise at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.neo4j:neo4j (Maven): upgrade to 2026.01 or later

  ```sh
  # set org.neo4j:neo4j to 2026.01 in your pom.xml or build.gradle
  ```


## Technical details

The vulnerability is a log injection flaw in the Neo4j query log handler. The root cause is insufficient escaping of control characters (specifically newline characters) in the transaction metadata field when logs are written in plain-text format (not JSON). An authenticated user can craft a transaction with metadata containing newline characters, causing the metadata to break out of its log line and inject fake query entries that appear legitimate. The attack requires database authentication and can only occur when Neo4j is not configured to output logs in JSON format. The injected entries do not execute as queries but corrupt the log audit trail. Patching is available in Neo4j version 2026.01 and later.

## Affected products

- Neo4j Neo4j Community prior to 2026.01
- Neo4j Neo4j Enterprise prior to 2026.01

## Identifiers

- CVE-2026-1337
- GHSA-xr72-g735-4vwp

## Timeline

- 2026-02-06: disclosed: Vulnerability published

## References

- [https://mvnrepository.com/artifact/org.neo4j/neo4j](https://mvnrepository.com/artifact/org.neo4j/neo4j)
- [https://github.com/JoakimBulow/CVE-2026-1337](https://github.com/JoakimBulow/CVE-2026-1337)

## Related threats

- [Neo4j Enterprise and Community vulnerable to a potential information disclosure](https://junglewise.ai/threats/cve-2026-1622-neo4j-enterprise-and-community-vulnerable-to-a-potential)
- [Neo4J vulnerable to Cross-Site Request Forgery](https://junglewise.ai/threats/cve-2013-7259-neo4j-vulnerable-to-cross-site-request-forgery)
- [Deserialization of Untrusted Data in Neo4j](https://junglewise.ai/threats/cve-2021-34371-deserialization-of-untrusted-data-in-neo4j)