Quick answers
- Is CVE-2026-92683 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-92683 being exploited in the wild.
- How severe is CVE-2026-92683?
- Informational severity, published 9 November 2026.
- Which products and versions are affected?
- Neo4j @Neo4j/Graphql 7.0.0 to before 7.6.7.
- Is there a fix for CVE-2026-92683?
- Yes: fixed in 7.6.7. Until then: Express multi-condition JWT filters using an explicit AND array syntax (jwt: { AND: [{ iss: { eq: "https://idp.example.com" } }, { roles: { includes: "admin" } }] }) or with inline operator syntax (roles_INCLUDES: "admin") instead of generic operator syntax, both of which evaluate all conditions correctly. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-92683 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-92683?
- Check whether you run Neo4j @Neo4j/Graphql at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: 7.6.7
Express multi-condition JWT filters using an explicit AND array syntax (jwt: { AND: [{ iss: { eq: "https://idp.example.com" } }, { roles: { includes: "admin" } }] }) or with inline operator syntax (roles_INCLUDES: "admin") instead of generic operator syntax, both of which evaluate all conditions correctly.
Technical details
The @authentication directive in @neo4j/graphql fails to evaluate all conditions when a JWT where filter uses generic operator syntax with multiple conditions. Only the first condition is evaluated while subsequent conditions are silently ignored. An attacker with a valid JWT that satisfies the first condition (e.g., issuer check) can bypass role or other authorization checks if they are expressed as subsequent conditions, resulting in unauthorized access to protected GraphQL operations and data.
Affected products
- Neo4j @neo4j/graphql 7.0.0 to before 7.6.7
Timeline
- 2026-11-05: disclosed
- 2026-11-09: advisory