CVE-2026-46591 Apache CVE debrief

Who should care

Users of Apache Camel, especially those using the Neo4J component, should be aware of this vulnerability and take steps to mitigate it by upgrading to a fixed version or implementing compensating controls. This includes operators, platform administrators, vulnerability management teams, and security teams who need to assess the impact of this vulnerability on their environment and take appropriate action.

Technical summary

The camel-neo4j producer builds the Cypher WHERE clause for its match/retrieve and delete operations from the CamelNeo4jMatchProperties map. CVE-2025-66169 addressed Cypher injection through the property values by binding them as query parameters ($paramN), but the property names (the JSON keys of that map) were still concatenated into the query string verbatim in Neo4jProducer.retrieveNodes() and deleteNode(). A property name containing Cypher syntax therefore alters the structure of the executed query. Where a route maps untrusted input into the CamelNeo4jMatchProperties map - for example by passing a request body as the match map, or from a consumer that does not filter inbound Camel* headers - an attacker who controls the JSON key names can inject arbitrary Cypher and read, modify or delete any node or relationship in the Neo4j database.

Defensive priority

High

Recommended defensive actions

• Upgrade to Apache Camel version 4.21.0 or later
• If using 4.14.x LTS releases, upgrade to 4.14.8
• If using 4.18.x releases, upgrade to 4.18.3
• Validate or allow-list property names before the Neo4j producer
• Ensure consumers filter inbound Camel* / camel* headers
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and vendor advisory provide details on the vulnerability and affected versions. Evidence is limited to public sources and may not reflect the full scope or impact of the vulnerability. Defenders should verify the affected versions and product deployments in their environment, and review the official advisory for specific guidance on mitigation and remediation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.