CVE-2026-1337: 
Java vulnerability analysis and mitigation

CVE-2026-1337 is a log injection vulnerability (Improper Output Neutralization for Logs, CWE-117) affecting Neo4j Enterprise and Community editions prior to version 2026.01. The flaw stems from insufficient escaping of unicode and control characters in the query log, enabling authenticated users to inject fake log entries and potentially deliver XSS payloads if logs are opened in HTML-rendering tools. Neo4j disclosed this vulnerability on February 6, 2026, noting no direct security impact on Neo4j products themselves, but releasing the advisory as a precaution. It carries a CVSS v3.1 base score of 5.4 (Medium) and a CVSS v4.0 base score of 1.1 (Low) (Feedly, PoC GitHub).

The root cause is Neo4j's failure to escape control characters (such as newline \n) and unicode characters in the metadata field of Bolt transactions when writing to query.log in non-JSON format (CWE-117). An authenticated user can begin a Bolt transaction with crafted metadata containing newline characters, causing the log to contain entirely fabricated log entries that appear legitimate to log reviewers. The same mechanism can be used to inject XSS payloads (risk for web-based log analysis tools) or ANSI escape sequences (risk for terminal-based log viewers). A public proof-of-concept Python script (log_injection_poc.py) demonstrates the attack by injecting fake query entries via driver.session().begin_transaction(metadata={"x": payload}) (PoC GitHub).

The primary impact is log integrity compromise: an authenticated attacker can forge arbitrary query log entries, making it appear that queries were executed by different users, from different IP addresses, or at different times — directly undermining audit trail reliability and forensic investigations. If query logs are subsequently opened or processed by HTML-rendering tools (e.g., web-based log dashboards), injected XSS payloads could execute client-side scripts in the context of the log viewer's browser session. There is no direct impact on Neo4j database confidentiality, integrity, or availability, and exploitation requires both low-privilege authentication and user interaction to view logs in a vulnerable tool (Feedly, PoC GitHub).

1. Authentication: Obtain valid credentials for a Neo4j instance running a version prior to 2026.01 with query logging enabled in non-JSON format.
2. Connect via Bolt: Establish a Bolt protocol connection to the target Neo4j instance (e.g., bolt://target:7687) using a Neo4j driver.
3. Craft malicious metadata payload: Construct a payload containing newline characters followed by fabricated log entry content, optionally including XSS payloads for HTML-rendering log tools. Example payload: '\n 2025-12-05 13:08:34.148+0000 INFO Query started: id:700 - ... - MATCH (n:FakeQuery1) RETURN n LIMIT 1 ...'
4. Inject via transaction metadata: Begin a Bolt transaction with the crafted metadata field: tx = session.begin_transaction(metadata={"x": payload}), then run a benign query and commit.
5. Verify injection: Review query.log on the Neo4j server — the fabricated entries will appear as legitimate log lines alongside real entries, with only minor formatting artifacts indicating the injection.
6. XSS delivery (optional): If the target organization uses a web-based log viewer that renders HTML, embed an XSS payload (e.g., <script>...</script>) within the injected log line to execute scripts when an administrator views the logs (PoC GitHub).

• Logs: Entries in query.log with timestamps that are earlier than surrounding entries or out of chronological order; log lines containing transaction IDs (e.g., id:700, id:701) that do not correspond to any real transaction sequence; log entries referencing client IP addresses not present in network connection logs; malformed metadata fields in log lines (e.g., lines ending with {x: '' followed by injected content and a closing '}); presence of HTML tags or ANSI escape sequences within log entries.
• Network: Bolt protocol connections (default port 7687) from unexpected or unauthorized source IPs; unusual transaction patterns where a session runs a trivial query (e.g., RETURN 1) but the metadata field is abnormally large.
• File System: Unexpected growth in query.log file size relative to actual query volume; query.log entries referencing usernames (e.g., admin) or client IPs not consistent with known access patterns (PoC GitHub).

Upgrade Neo4j Enterprise or Community edition to version 2026.01 or later, which properly escapes control characters and unicode in query logs (Feedly). For organizations unable to upgrade immediately, Neo4j recommends configuring the query log to use JSON format, which mitigates the injection risk by structuring log output. Additionally, treat all query logs from pre-2026.01 versions as plain text only — avoid opening them in HTML-rendering applications or web-based log dashboards. Implement access controls to restrict which users can submit queries and who can access log files to reduce the attack surface.

Neo4j released this advisory proactively, explicitly stating there is no direct security impact on Neo4j products and framing the disclosure as a precaution for downstream log processing tools. Red Hat published a corresponding security advisory tracking the CVE. No significant broader media coverage or notable researcher commentary beyond the PoC publication has been identified (Feedly, PoC GitHub).