CVE-2026-46591

Name of the Vulnerable Software and Affected Versions Apache Camel versions 4.10.0 through 4.14.7 Apache Camel versions 4.15.0 through 4.18.2 Apache Camel versions 4.19.0 through 4.20.x

Description An issue exists in the Apache Camel Neo4J component where the producer builds the Cypher WHERE clause for match, retrieve, and delete operations using the CamelNeo4jMatchProperties map. While property values are bound as parameters, the property names (JSON keys of the map) are concatenated directly into the query string within the retrieveNodes() and deleteNode() functions. This allows an attacker who can control the JSON key names to inject arbitrary Cypher syntax, potentially enabling them to read, modify, or delete any node or relationship in the Neo4J database. This is possible in routes that map untrusted input into the CamelNeo4jMatchProperties map or use consumers that do not filter inbound Camel headers.

Recommendations Upgrade to version 4.14.8 for those on the 4.14.x LTS releases stream. Upgrade to version 4.18.3 for those on the 4.18.x releases stream. Upgrade to version 4.21.0. As a temporary mitigation, do not populate the CamelNeo4jMatchProperties map from untrusted input by validating or allow-listing property names against the regex ^[A-Za-z ][A-Za-z0-9 ]*$ before the Neo4J producer. Ensure that any consumer feeding the route filters inbound Camel* and camel* headers to prevent external senders from supplying the match header.