{"answers":{"affected":"6 open source packages ship an affected version, including org.apache.camel:camel-neo4j. It affects 1 product.","exploited":"There is no known exploitation of CVE-2026-46591 in the wild and no public exploit code.","fix":"Upgrade org.apache.camel:camel-neo4j to a fixed version for your release line: 4.14.8, 4.18.3 or 4.21.0.","what":"CVE-2026-46591 is a high-severity code injection vulnerability in Apache Camel, published on 6 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-46591 and fix it if it is affected.\n\nWhat it is: CVE-2026-46591 is a high-severity code injection vulnerability in Apache Camel, published on 6 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-46591 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- org.apache.camel:camel-neo4j (Maven): affected from 4.10.0; fixed in 4.14.8\n- org.apache.camel:camel-neo4j (Maven): affected from 4.10.0; fixed in 4.14.8\n- org.apache.camel:camel-neo4j (Maven): affected from 4.15.0; fixed in 4.18.3\n- org.apache.camel:camel-neo4j (Maven): affected from 4.15.0; fixed in 4.18.3\n- org.apache.camel:camel-neo4j (Maven): affected from 4.19.0; fixed in 4.21.0\n- org.apache.camel:camel-neo4j (Maven): affected from 4.19.0; fixed in 4.21.0\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-46591/ (Markdown: https://insights.sbomify.com/CVE-2026-46591/index.md)","id":"CVE-2026-46591","markdown":"https://insights.sbomify.com/CVE-2026-46591/index.md","name":"CVE-2026-46591","record":{"aliases":["GHSA-q86m-qjpm-vqcw"],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["data_read","data_modify"],"network_reachable":"yes","non_default_config":true,"product_category":"Apache Camel Neo4j","requires_auth":"none","summary":"Attackers can inject Cypher queries via JSON keys in the CamelNeo4jMatchProperties header to read, modify, or delete database nodes.","user_interaction":"not_required","vuln_class":"code_injection"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"apache","cpe":[{"product":"camel","vendor":"apache"}],"cvss":{"score":8.2,"severity":"high","source":"cisa-adp","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N","version":"3.1"},"cwes":[{"id":"CWE-943","name":"Improper Neutralization of Special Elements in Data Query Logic"}],"description":"Improper Neutralization of Special Elements in Data Query Logic vulnerability in Apache Camel Neo4J component.\n\nThe camel-neo4j producer builds the Cypher WHERE clause for its match/retrieve and delete operations from the CamelNeo4jMatchProperties map. CVE-2025-66169 addressed Cypher injection through the property values by binding them as query parameters ($paramN), but the property names (the JSON keys of that map) were still concatenated into the query string verbatim in Neo4jProducer.retrieveNodes() and deleteNode(). A property name containing Cypher syntax therefore alters the structure of the executed query. Where a route maps untrusted input into the CamelNeo4jMatchProperties map - for example by passing a request body as the match map, or from a consumer that does not filter inbound Camel* headers - an attacker who controls the JSON key names can inject arbitrary Cypher and read, modify or delete any node or relationship in the Neo4j database. The CamelNeo4jMatchProperties header is itself Camel-prefixed and is filtered by the HTTP header-filter strategy, so a plain HTTP client cannot set it directly; the issue is reachable through routes that deliberately or inadvertently carry untrusted data into that header.\nThis issue affects Apache Camel: from 4.10.0 before 4.14.8, from 4.15.0 before 4.18.3, from 4.19.0 before 4.21.0.\n\nUsers are recommended to upgrade to version 4.21.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.8. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.3. For deployments that cannot upgrade immediately, do not populate the CamelNeo4jMatchProperties map from untrusted input: validate or allow-list the property names (for example against ^[A-Za-z_][A-Za-z0-9_]*$) before the Neo4j producer, and ensure that any consumer feeding such a route filters inbound Camel* / camel* headers so the match header cannot be supplied by an external sender.","ecosystems":["Maven"],"exploits":{"exploitdb":0,"first_seen":"2026-07-15","github_poc":1,"max_poc_stars":0,"metasploit":0,"nuclei":0,"refs":[{"date":"2026-07-15T19:13:53Z","kind":"github_poc","ref":"https://github.com/oscerd/CVE-2026-46591","stars":0,"title":"Reproducer for CVE-2026-46591: Apache Camel camel-neo4j Cypher injection via property names in CamelNeo4jMatchProperties, enabling authorization bypass / cross-label data exfiltration (fixed in 4.14.8/4.18.3/4.21.0)"}],"tier":"poc_unverified"},"has_fix":true,"headline":"Apache Camel-Neo4j: JSON property names from the CamelNeo4jMatchProperties header are interpolated into the Cypher WHERE clause without validation, allowing Cypher injection (incomplete remediation of CVE-2025-66169)","id":"CVE-2026-46591","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"Maven","product":"apache:camel","products":["apache:camel"],"type":"code_injection","year":"2026"},"n_packages":6,"n_references":1,"next":{"headline":"Apache Camel-CXF: The SOAP operation-selection headers used non-Camel-prefixed names (operationName, operationNamespace) that bypass the HTTP header filter, allowing an HTTP client to redirect the invoked SOAP operation","id":"CVE-2026-46592"},"packages":[{"ecosystem":"Maven","fixed":["4.14.8"],"introduced":["4.10.0"],"last_affected":[],"package":"org.apache.camel:camel-neo4j","purl":null,"source":"GHSA-q86m-qjpm-vqcw"},{"ecosystem":"Maven","fixed":["4.14.8"],"introduced":["4.10.0"],"last_affected":[],"package":"org.apache.camel:camel-neo4j","purl":"pkg:maven/org.apache.camel/camel-neo4j","source":"GHSA-q86m-qjpm-vqcw"},{"ecosystem":"Maven","fixed":["4.18.3"],"introduced":["4.15.0"],"last_affected":[],"package":"org.apache.camel:camel-neo4j","purl":null,"source":"GHSA-q86m-qjpm-vqcw"},{"ecosystem":"Maven","fixed":["4.18.3"],"introduced":["4.15.0"],"last_affected":[],"package":"org.apache.camel:camel-neo4j","purl":"pkg:maven/org.apache.camel/camel-neo4j","source":"GHSA-q86m-qjpm-vqcw"},{"ecosystem":"Maven","fixed":["4.21.0"],"introduced":["4.19.0"],"last_affected":[],"package":"org.apache.camel:camel-neo4j","purl":null,"source":"GHSA-q86m-qjpm-vqcw"},{"ecosystem":"Maven","fixed":["4.21.0"],"introduced":["4.19.0"],"last_affected":[],"package":"org.apache.camel:camel-neo4j","purl":"pkg:maven/org.apache.camel/camel-neo4j","source":"GHSA-q86m-qjpm-vqcw"}],"prev":{"headline":"Apache Camel-PQC: The HashiCorp Vault and AWS Secrets Manager key-lifecycle managers deserialize persisted key metadata with java.io.ObjectInputStream and no ObjectInputFilter (incomplete remediation of CVE-2026-40048)","id":"CVE-2026-46590"},"products":["Apache Camel"],"published":"2026-07-06","related":[{"cvss_score":10,"headline":"Apache camel-coap allows header injection that can lead to remote code execution","id":"CVE-2026-33453","kev_date_added":null,"published":"2026-04-27"},{"cvss_score":9.9,"headline":"Apache Camel has an incomplete fix for CVE-2025-27636","id":"CVE-2026-40453","kev_date_added":null,"published":"2026-04-27"},{"cvss_score":9.8,"headline":"Apache Camel K: Camel K Tenant repositories reach Maven execution inside operator pod","id":"CVE-2026-80351","kev_date_added":null,"published":"2026-09-10"},{"cvss_score":9.8,"headline":"Apache Camel K: Camel K Master trait serviceAccountName YAML injection lets CR author apply arbitrary objects","id":"CVE-2026-80352","kev_date_added":null,"published":"2026-09-10"},{"cvss_score":9.8,"headline":"Apache Camel: Camel-Atmosphere-Websocket: WebSocket dispatch header injection","id":"CVE-2026-71300","kev_date_added":null,"published":"2026-08-24"},{"cvss_score":9.8,"headline":"Apache Camel-Undertow: the endpoint discarded the undertow-specific header filter strategy in favour of the base HTTP one, so the undertow filtering never ran on endpoint-configured routes","id":"CVE-2026-78329","kev_date_added":null,"published":"2026-08-24"},{"cvss_score":9.8,"headline":"Apache Camel-PQC: The AWS Secrets Manager key-lifecycle manager deserializes persisted key metadata with java.io.ObjectInputStream and no ObjectInputFilter","id":"CVE-2026-43867","kev_date_added":null,"published":"2026-07-06"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"},{"class":"open","licence":"CC0","name":"PoC-in-GitHub"}],"ssvc":{"automatable":"yes","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-07-06","vendors":["Apache Software Foundation"]},"summary":"Attackers can inject Cypher queries via JSON keys in the CamelNeo4jMatchProperties header to read, modify, or delete database nodes.","url":"https://insights.sbomify.com/CVE-2026-46591/"}