CVE-2026-19869 neo4j CVE debrief

Who should care

Defenders and developers using @neo4j/graphql in their systems, especially those with custom GraphQL operations and authentication rules, should assess exposure and prioritize verification and remediation.

Why it matters

CVE-2026-19869 is a high-severity vulnerability in @neo4j/graphql that allows clients with non-admin tokens to invoke restricted fields when both type-level and field-level authentication rules are present. Defenders should prioritize verifying patched versions, assessing exposure, and adjusting authentication rules.

• Potential unauthorized access to restricted fields
• Bypass of stricter field-level authentication requirements
• Increased risk of data exposure or manipulation
• Need for verification of patched versions and authentication rule configurations

Technical summary

The @neo4j/graphql library from version 5.2.0 until the patched versions fails to enforce field-level @authentication rules on root custom-resolver fields when a type-level @authentication rule is also present. This causes the field-level rule to be silently discarded, allowing clients with a legitimately issued non-admin token to invoke more-restricted fields. Defenders should prioritize verifying patched versions and assessing exposure in their systems, especially those with custom GraphQL operations and authentication rules. The vulnerability allows clients with non-admin tokens to invoke restricted fields, potentially leading to unauthorized access and data exposure.

Defensive priority

Defenders should prioritize verifying the presence of patched versions and assessing exposure in their systems.

Recommended defensive actions

• Verify the presence of patched versions of @neo4j/graphql in your systems.
• Assess exposure by checking if both type-level and field-level @authentication rules are used in your GraphQL operations.
• Update to the patched versions as soon as possible.
• Review and adjust your authentication rules to ensure proper enforcement.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The vulnerability is described in the CVE record and source references. However, the scope of affected versions and systems requires verification from the supplied official sources. The CVE Program and NVD provide details on the vulnerability, but defenders need to verify patched versions and assess exposure in their systems. This includes checking for custom GraphQL operations and authentication rules that may be impacted. Evidence limits suggest focusing on official sources and vendor guidance for accurate information.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.