Cloud Vulnerability DB
A community-led vulnerabilities database
Vulnerability DatabaseCVE-2025-66169
CVE-2025-66169:
Java vulnerability analysis and mitigation
Overview
CVE-2025-66169 is a Cypher Injection vulnerability in the Apache Camel camel-neo4j component that allows unauthenticated remote attackers to inject malicious Cypher queries into Neo4j database operations. It affects Apache Camel versions 4.10.0 through 4.10.7, 4.14.0 through 4.14.2, and 4.15.0 through 4.16.x. The vulnerability was disclosed on January 14, 2026, and patched versions were made available concurrently. It carries a CVSS v3.1 base score of 5.3 (Medium), assessed by CISA-ADP (GitHub Advisory, Apache Advisory).
Technical details
The root cause is improper neutralization of special elements in query construction (CWE-89), where the camel-neo4j component previously concatenated user-supplied input directly into Cypher query strings rather than using parameterized queries. Specifically, the Neo4jProducer class built CREATE, MATCH, and DELETE Cypher statements by embedding raw message body content and MATCH_PROPERTIES header values directly into query strings — for example, CREATE (alias:label <body>) and MATCH (alias:label <matchQuery>). The fix, merged November 24, 2025 (CAMEL-22719), replaced string interpolation with parameterized queries using $props and $paramN placeholders, and added JSON parsing of inputs via Jackson's ObjectMapper before binding them as query parameters (GitHub PR #20035, GitHub Commit). No authentication is required to trigger the vulnerability if the Camel route exposes an endpoint that processes external input through the camel-neo4j component.
Impact
Successful exploitation could allow an attacker to inject arbitrary Cypher queries into Neo4j database operations performed by the Camel application, potentially resulting in unauthorized data access, modification, or deletion of graph database records. The actual impact is bounded by the permissions of the Neo4j database user account configured in the Camel application — a least-privilege account limits exposure, while a highly privileged account could allow full database compromise. Confidentiality impact is assessed as none in the CVSS scoring, with integrity impact rated low, and no availability impact, suggesting the primary risk is unauthorized data manipulation rather than data exfiltration or service disruption (GitHub Advisory, Apache Advisory).
Exploitation steps
- Identify target: Locate an Apache Camel application using the
camel-neo4jcomponent (versions 4.10.0–4.10.7, 4.14.0–4.14.2, or 4.15.0–4.16.x) that accepts external input routed through Neo4j operations such as CREATE_NODE, RETRIEVE_NODES, or DELETE_NODE. - Craft malicious payload: Prepare a Cypher injection payload. For a
CREATEoperation, supply a message body string that breaks out of the intended node property context — e.g.,{name: 'x'}) MATCH (n) DETACH DELETE n //— which would be interpolated directly into the query asCREATE (alias:label {name: 'x'}) MATCH (n) DETACH DELETE n //). - Inject via MATCH_PROPERTIES header: For
RETRIEVE_NODESorDELETE_NODEoperations, set theMATCH_PROPERTIESCamel message header to a crafted string such as{name: 'x'} RETURN n //to manipulate the resulting MATCH query. - Submit the request: Send the crafted message to the Camel route endpoint (e.g., via HTTP, messaging queue, or other transport depending on the route configuration).
- Achieve objective: The unpatched component interpolates the payload directly into the Cypher query string sent to Neo4j, executing the injected query under the permissions of the configured database user, potentially reading, modifying, or deleting graph data (GitHub PR #20035, Apache Advisory).
Indicators of compromise
- Logs: Neo4j query logs containing unexpected Cypher syntax such as multiple statements,
DETACH DELETE,MATCH (n), or comment markers (//) within queries generated by the Camel application; Camel application logs showingNeo4jOperationExceptionor JSON parse errors from theNeo4jProducerclass after patching (indicating attempted injection with malformed input). - Network: Unusual or malformed payloads in message bodies or headers (
MATCH_PROPERTIES) sent to Camel routes that interface with Neo4j; unexpected volume of Neo4j write or delete operations originating from the Camel service account. - Database: Unexpected deletion, modification, or creation of Neo4j nodes or relationships inconsistent with normal application behavior; audit logs in Neo4j showing queries with injected clauses executed under the application service account.
Mitigation and workarounds
Apache has released patched versions addressing this vulnerability: 4.10.8 (for the 4.10.x LTS line), 4.14.3 (for the 4.14.x LTS line), and 4.17.0 (for 4.15.x and later). Users should upgrade to the appropriate patched version as the primary remediation. As a defense-in-depth measure, restrict the Neo4j database user account used by the Camel application to the minimum required permissions (e.g., read-only if writes are not needed). Additionally, implement input validation at the application layer to reject unexpected characters in data routed through camel-neo4j operations (Apache Advisory, GitHub Advisory).
Community reactions
The vulnerability was disclosed via the Apache security mailing list and the oss-security list on January 13–14, 2026, with standard community notification (oss-security). Social media activity was limited, with brief mentions on Bluesky and Mastodon infosec communities noting the advisory. No significant vendor statements beyond the official Apache advisory or notable independent researcher commentary have been identified.
Additional resources
Source: This report was generated using AI
Related Java vulnerabilities:
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Additional Wiz resources
Get a personalized demo
Ready to see Wiz in action?
"Best User Experience I have ever seen, provides full visibility to cloud workloads."
David EstlickCISO
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
Adam FletcherChief Security Officer
"We know that if Wiz identifies something as critical, it actually is."
Greg PoniatowskiHead of Threat and Vulnerability Management