Executive brief
Apache Camel's Neo4j integration allows applications to query and modify graph databases. The component builds database queries by concatenating user-supplied property names directly into query strings without validation. An attacker who controls these property names—through routes that map untrusted input into the query map—can inject database commands to read, modify, or delete sensitive data. This vulnerability bypasses an earlier security fix that only protected the values, not the keys.
Technical details
The vulnerability is a database query injection flaw (CWE-943) in the Neo4jProducer.retrieveNodes() and deleteNode() methods. These methods construct Cypher WHERE clauses by directly concatenating JSON property names from the CamelNeo4jMatchProperties map into the query string, while property values are safely bound as parameters ($paramN). An attacker controlling the JSON keys can inject Cypher syntax to alter query structure. The attack is reachable when a Camel route maps untrusted input (e.g., a request body or inbound headers) into the CamelNeo4jMatchProperties header. The header is Camel-prefixed and normally filtered by HTTP headers, but the vulnerability materializes when routes deliberately or inadvertently carry untrusted data into this header. An unauthenticated, network-accessible attacker with ability to influence message flow can achieve arbitrary read, modification, and deletion of Neo4j data.
Affected products
- Apache Camel 4.10.0 to 4.14.7, 4.15.0 to 4.18.2, 4.19.0 to 4.20.x
Timeline
- 2026-07-06: disclosed
- 2026-07-06: patched: Patches released: 4.14.8, 4.18.3, 4.21.0